Terms of Service

This document is published in several languages. In the event of any discrepancy between the language versions, the Polish version is binding.

Version 2.2 · Last updated: 29 October 2026

The essentials first. Five points come before the small print, because anyone who misunderstands them will misunderstand everything that follows:

• Accounts are for businesses only. Anyone can use the free check on the home page; the account, the plans and all other features are aimed at companies, self-employed professionals and agencies (clause 1.3). Mandatory protection of certain sole traders under Polish law remains unaffected (clauses 1.3 and 36).
• We only check websites you are entitled to control. Without proof of control, we check only passively, the way a visitor sees a page. Test submissions through your forms only happen after proof of control, and then expressly on your instructions (clauses 7 and 8).
• A result is a snapshot, not a guarantee. The checks are automated and based on detection rules. “Protected” does not mean that no more spam will arrive, and it does not replace a penetration test, legal advice or a certification (clause 5).
• We receive no access to your servers. We neither request nor receive FTP, SSH, hosting or administrator access. If you want a check behind a login, you create a test account on your website for it yourself; that is the only case in which the Service uses login credentials (clauses 10 and 12).
• The Polish version prevails, and Polish law applies. These Terms are available in all official languages of the European Union (clause 39).

1. Provider, scope and contractual partner

1.1 The provider

The formexposed service is provided by Lukas Wójcik, who runs a sole proprietorship registered in the Polish Central Register and Information on Economic Activity (CEIDG) under the business name LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, NIP 7252266190, VAT ID PL7252266190 (“we”, “us”). Contact: contact@lukaswojcik.com, the support window (question mark in the navigation) and the contact page. Further details are given in the Imprint.

1.2 What this document is

These Terms of Service (the “Terms”) govern the provision and use of formexposed at formexposed.com and form.exposed, including the free check, the customer account, the WordPress plugin, the TYPO3 extension, the MainWP extension, the application programming interface (API), the MCP server and the templates for automation services (together the “Service”).

They are also the regulations (regulamin) for the services provided by electronic means within the meaning of Art. 8 of the Polish Act of 18 July 2002 on Providing Services by Electronic Means (ustawa o świadczeniu usług drogą elektroniczną, “UŚUDE”). The information required there can be found in these Terms as follows: the type and scope of the services in clauses 5 to 16, the technical requirements in clause 27.6, the prohibition of unlawful content in clause 23, the conclusion and termination of contracts in clauses 4 and 20, and the complaints procedure in clause 35. The information under Art. 6 UŚUDE on specific risks of use and on software and data that we introduce into the Customer’s systems is set out in clauses 27.7 and 27.8.

The Terms are available free of charge at this address before any contract is concluded and can be retrieved, reproduced, saved and printed. We record which version the Customer has accepted (clause 4.4).

1.3 Who can use the Service

Free check. Anyone may use the free check without an account (clause 6) and the freely accessible tools, within the limits stated there.

Account and plans for businesses only. A customer account and all plans, including the free Free plan, are aimed exclusively at businesses: natural persons, legal persons and partnerships with legal capacity that use the Service for their commercial or independent professional activity (the “Customer”). By registering, the registering person confirms that they are using the Service for a business. We deliberately do not aim the Service at consumers: it checks forms on websites that are operated commercially, and its rules on liability, warranty and changes are tailored to the relationship between businesses.

Sole traders with consumer protection. Polish law grants certain consumer rights to a natural person who concludes a contract directly connected with their business activity but for whom, according to its content, the contract is not of a professional nature (przedsiębiorca na prawach konsumenta; Art. 385⁵ and 556⁴ of the Polish Civil Code, Kodeks cywilny, “KC”, and Art. 38a of the Polish Consumer Rights Act, ustawa o prawach konsumenta). The confirmation given at registration does not exclude this protection. Clause 36 and the Right of Withdrawal for Sole Traders page apply to this group. Anyone who believes they belong to this group should tell us; we will examine it on a case-by-case basis. The protection does not depend on this notification; it only helps us to observe it.

No provision of these Terms is intended to exclude or restrict a right that cannot validly be excluded or restricted. If a provision does not apply to a particular Customer because of mandatory law, the remaining provisions and their application to all other Customers remain unaffected.

1.4 Acting for a business

Anyone who registers or orders on behalf of a business warrants that they have full legal capacity and are authorised to represent the business to that extent. The contractual partner is the business on whose behalf they act; if no business is stated, it is the registering person themselves as a business. If the authority to represent is lacking, the person acting is liable under Art. 103 § 3 KC.

1.5 Territorial restrictions

The Service is not offered to, and may not be used by or for the benefit of, persons and entities that are the target of economic sanctions or export restrictions of the European Union or the United Nations or that are resident in a comprehensively sanctioned territory. The Customer warrants that they do not belong to this group and will not permit such use. If we become aware of a breach, we may block or terminate immediately.

2. Definitions

The following terms have the meaning given in these Terms. In a data protection context, the terms of the Data Processing Agreement and of the General Data Protection Regulation (GDPR) apply.

Term	Meaning
Active check	A check in which the Service sends labelled test submissions through a detected contact form of a verified domain (clause 8.2).
Alert	A message from the Service to a destination set up by the Customer (e-mail, webhook, chat service) when a check result or a monitored state changes.
Workspace	The unit in the account to which domains, members, alert destinations, brand and client portals are assigned. Called “workspace” in the English interface.
DPA	The Data Processing Agreement under Art. 28 GDPR, which the Customer concludes when registering.
Domain	A host name of a website that the Customer adds to their account. The domain is the unit by which plan limits are counted and checks are scheduled.
Extension	The WordPress plugin, the TYPO3 extension and the MainWP extension of formexposed, in each case in the version installed by the Customer.
Free check	The passive check of a domain without an account via the input field on the home page (clause 6).
Customer	The business that concludes the contract for an account with us. Where a workspace exists, the Customer for it is whoever holds the owner role there.
Customer data	Personal data of third parties that the Customer brings into the Service or allows to enter the Service through their configuration, such as copies of form e-mails in the delivery check, subscribers to a client portal or the login credentials of a test account. We process them as a processor (clause 24).
Member	A natural person to whom the Customer grants access to a workspace in the owner, admin or viewer role.
Monitoring	The recurring check of a verified domain at the frequency of the plan, together with the watchers under clause 9.
Proof of control	The evidence that the Customer is entitled to control a domain, by DNS record, meta tag, file, extension or rollout code (clause 7.2). A domain with valid proof of control is called “verified”.
Passive check	A check in which the Service fetches public pages as a visitor would and submits nothing (clause 8.1).
Pricing page	The Pricing page with the plans, their limits and fees in the version in force at the time.
Report	The presentation of a check result at an address with a random token. Anyone who knows the address can open the report without signing in.
Plan	The tier chosen by the Customer (currently Free, Small, Pro or Business) with the features and limits stated on the pricing page.
Test submission	A message sent by the Service through a contact form and labelled as an automated test in its sender, subject and text.
Text form	A legible declaration on a data carrier that identifies the person making it, such as an e-mail or a letter. It corresponds to the documentary form (forma dokumentowa) under Art. 77² KC. Where these Terms say so, a message in a chat or support window is not sufficient.
Website	The pages reachable under a domain, together with their forms.

3. The contract documents and their order of precedence

3.1 What the contract consists of

The contract between the Customer and us consists of the following documents, each incorporated by reference:

1. an individual agreement made in text form, if there is one;
2. these Terms;
3. the Data Processing Agreement;
4. the Technical and Organisational Measures;
5. the list of sub-processors;
6. the Acceptable Use and Abuse page;
7. the pricing page in the version in force at the time of the order, to the extent that it states plans, limits and fees.

The version published at the time the contract was concluded is authoritative in each case. Changes to these documents are subject to clause 34; for the Technical and Organisational Measures and the list of sub-processors, the change rules of the DPA take precedence, and for the features, limits and fees on the pricing page, clauses 5.5 and 19.8.

3.2 Order of precedence

If the documents conflict, the one higher up in the list in clause 3.1 prevails, and only to the extent of the conflict. By way of derogation, the DPA prevails over every other provision in all matters concerning the processing of personal data on behalf of the Customer, because these matters are subject to Art. 28 GDPR; only an individual agreement that the DPA permits, because it is made in text form and expressly refers to the DPA, prevails over it. The pages EU Data Act and Right of Withdrawal for Sole Traders prevail over all documents in the list to the extent that they give the Customer further-reaching rights (clauses 20.3 and 36).

3.3 Pages that inform but are not part of the contract

The Privacy Policy is information under Art. 13 and 14 GDPR about the processing for which we ourselves are responsible; it is not agreed to, but acknowledged. Likewise for information only are the pages EU AI Act, Complaints, Access, Erasure and Your Other Rights, the Records of Processing Activities, the Data Protection Impact Assessment, the Privacy Policy Text for Your Website, the page about our crawler (/bot), the overview Legal Documents at a Glance and the overview Changes to the Contract Documents; they do not constitute any warranty. The pages EU Data Act and Right of Withdrawal for Sole Traders are likewise for information, but form part of the contract to the extent that they grant the Customer rights (clause 3.2). Where these Terms refer to such a page to describe an obligation or a right, the obligation or right applies as described there.

3.4 Descriptive statements are not warranties

The home page, the landing page at form.exposed, blog posts, feature descriptions, comparisons, screen images and statements made in support describe the Service and make it easier to understand. They are not guarantees or agreements on quality and do not become part of the contract unless we expressly designate a property as warranted in text form. If they conflict with the contract documents, the contract documents apply. In relation to sole traders within the meaning of clause 1.3, the statutory requirements for conformity with the contract remain unaffected, to the extent that they apply to them and take public statements into account.

This clause is not a licence to mislead. If a description is inaccurate, we correct it. It is here because the description of a service that is continuously being developed is written for readers, revised frequently and necessarily shorter than reality, and because what is owed must be traceable to a document that says exactly that.

3.5 The Customer’s own terms do not apply

Purchasing conditions, supplier codes of conduct and other general terms and conditions of the Customer do not apply, even if we do not object to them separately or perform the contract in the knowledge of them. Deviations require our express consent in text form. We answer supplier due diligence questionnaires on request; the answers describe the Service but do not change these Terms.

4. Conclusion of the contract and its evidence

4.1 The free check

Anyone who enters a domain in the input field on the home page and starts the check uses a free electronic service. These Terms apply to it to the extent that they concern the free check (in particular clauses 5, 6, 8.1, 23 and 29). No account is created as a result. The service ends when the report is provided; no termination is needed.

4.2 Registration

The contract for an account on the Free plan is concluded when the registering person submits the form under Register and, by ticking a box in the form, accepts these Terms and the DPA, confirms that they use formexposed for their business, and acknowledges the Privacy Policy. The account becomes usable once the e-mail address is confirmed. We delete an account whose e-mail address is never confirmed after 30 days.

The presentation of the plans on the pricing page is an invitation to submit an offer, not a binding offer.

4.3 Paid plans

A contract for a paid plan is concluded when the Customer selects a plan, a billing period and a currency in the Billing area and completes the checkout with our payment service provider; the confirmation of the subscription by the payment service provider counts as our acceptance. For payment on invoice (clause 19.6), it is concluded when the invoice is issued. A paid plan requires an account; the contract for the account continues alongside it. If the Customer starts a trial period (clause 19.4), the contract for the plan is concluded when this process is completed; it is free of charge until the end of the trial period and thereafter continues for a fee in accordance with clause 19.4 or ends.

4.4 The record of consent

At registration, for every document accepted or acknowledged (Terms, DPA, Privacy Policy), we record: the complete wording of the version displayed, including language and address, a checksum of this wording (SHA-256), the time, the IP address from which consent was given and the browser identifier. The wording is stored as it was displayed, that is, with the values inserted at display time, such as periods.

Two things follow from this, and both are intended. First, the record is written in the same database transaction as the account: if the record cannot be written, no account is created; if one of the documents is missing, registration is closed. Second, it can be established at any time which version a Customer agreed to and whether a document has changed since. The Customer finds the details of their consents in their data export.

The record is kept for as long as the account exists. If the account is deleted, it is kept until four years have passed since the consent, because questions about how a contract was concluded tend to arise precisely after it has ended.

4.5 Accuracy of information

When registering and ordering, the Customer provides accurate and complete information and keeps it up to date, in particular the e-mail address, the company name, the billing address and, where applicable, the VAT ID. This information is not a formality: all notices under these Terms go to the e-mail address (clause 38.5), and the tax treatment depends on the billing details.

4.6 Refusal

We may refuse a registration or order, in particular if there are indications that the Service is to be used contrary to clause 23, if an earlier account of the same person was blocked or terminated because of a breach, or if the information is obviously inaccurate.

4.7 Information on concluding the contract electronically

The technical steps leading to the conclusion of the contract are those of clauses 4.2 and 4.3. The Customer identifies and corrects input errors in the registration form before submitting it and, before completing the checkout, on the checkout page, which shows the plan, period and amount; the Customer can change details in the account afterwards in the settings. The confirmation of the subscription by the payment service provider is at the same time our acceptance (clause 4.3). We record the contract text in the record of consent (clause 4.4); on request, we send the Customer the wording of the version they accepted in text form. The contract can be concluded in any official language of the European Union (clause 39.3). We have not submitted to any code of conduct. In relations between businesses, the parties otherwise exclude Art. 66¹ § 1 to 3 KC (Art. 66¹ § 4 KC); we nevertheless provide the information in this clause.

5. What the Service is – and what it is not

5.1 What the Service provides

formexposed checks from the outside whether the contact forms of a website are protected against automated abuse, monitors this protection and reports changes. Depending on the plan and configuration, the Service includes in particular:

• Checks: passive checks of any domain and active checks with test submissions for verified domains (clause 8);
• Monitoring and alerts: recurring checks, form pulse, watchers for mail DNS, certificate, domain expiry, blocklists, known security vulnerabilities in form plugins and outages at CAPTCHA and mail providers, with alerts via the channels chosen by the Customer (clause 9);
• Browser journeys and scan behind the login (clause 10);
• Delivery check and check of the authenticity of the form e-mail (clause 11);
• Help with fixing: instructions, protection components for custom form code and “Fix it for me” with a language model (clause 12);
• Extensions for WordPress, TYPO3 and MainWP, for WordPress with a protection layer for forms (clause 13);
• Evidence and reports: badge, evidence log with timestamp, monthly report, notes on data protection, accessibility and scripts (clause 14);
• Features for agencies: portfolio, import, white-label reports, client portals, rollout codes and prospect check (clause 15);
• Interfaces: REST API, MCP server and templates for Zapier, Make, n8n and deployment pipelines (clause 16).

Which features a plan includes is stated on the pricing page. This clause describes the nature of the Service, not an exhaustive or fixed list of features.

5.2 Provision as software as a service

The Service is provided over the internet for the term of the contract. No copy of the server software is sold or handed over; the Customer acquires no rights to its source code or to our infrastructure. The extensions are subject to their own licence (clause 26.3). The Service runs on our own servers in Poland: a web server with a database and a scan server with a locally operated language model in the same internal network. The third parties we use for individual parts are named in the list of sub-processors.

5.3 A result is a snapshot

Every check is automated and based on detection rules that read a form, its fields and the recognisable protection measures (such as CAPTCHA, trap fields, tokens, time checks, throttling) from what a browser sees from the outside. It follows that:

• A result describes the state at the time of the check. Anything that changes afterwards will only be shown by the next check.
• Detection rules may overlook or misclassify a protection measure or report it as “not measurable”, for example if it only takes effect on the server, if a form is handled by a website builder service or if it only loads after an interaction that the check browser does not perform.
• The levels “Exposed”, “Partially protected” and “Protected” and the score are a weighted summary of individual findings. They are an assessment, not a measurement of spam and not a grade for the website as a whole.
• If a website is blocked for our crawler, for example by its robots.txt, a firewall or bot protection, a check remains incomplete or does not take place. This is not a defect of the Service.

5.4 What the Service is not

The following is stated expressly because a misunderstanding has consequences that cannot be remedied afterwards. The Service is not:

• a guarantee against spam or abuse. Even a well-protected form can receive spam, and attackers adapt. A “Protected” result says that the checked measures were present and worked, not that nothing will get through any more.
• a penetration test or a security audit by experts. The Service does not attack any website, does not search for vulnerabilities in general and does not test attacks on servers, databases or logins. The probe for injected header lines is limited to detection with a harmless test value (clause 8.2).
• legal advice. Notes on data protection, consent, accessibility, NIS2, PCI DSS or other legal matters are technical notes derived from what was measured. They do not assess whether a website is operated lawfully.
• a certification. Neither the badge nor the evidence log, the accessibility draft, the GDPR check or the script inventory is a certification, a mark of a conformity assessment body, an accessibility statement in the legal sense or proof of compliance with the GDPR, the accessibility requirements, PCI DSS or any standard.
• a measurement of all visitors. Measurements from our check browsers show what these browsers saw. They are not a measurement of what real visitors experience and prove neither conversion rates nor lost enquiries.
• a backup or an archive. Check results are deleted after set periods (clause 21). Anyone who needs results as evidence downloads them.
• access to the Customer’s systems. We do not install anything on the Customer’s servers and receive no server, FTP, SSH or administrator access (clause 12.3).

5.5 Further development

The Service is continuously being developed. We may add, change, replace and remove features, adjust detection rules and weights, and add or drop checks, namely for one of the following reasons: improving detection or usability, a change in the legal situation or in requirements of authorities, security, preventing abuse, the discontinuation or change of a service or interface of a third party on which the feature depends, low use of a feature, or replacement by an equivalent feature. If a result changes as a consequence, that is not a defect: a result is always the result of the rules that applied at the time of the check.

If a change materially reduces the functionality of a paid plan as a whole, we announce it at least 30 days in advance in text form. A reduction is always material if a feature stated on the pricing page for the plan booked is dropped without replacement or a limit stated there is lowered to the Customer’s detriment. The Customer may then terminate the plan as of the date the change takes effect and receives a pro rata refund of prepaid fees for the period thereafter. Changes that are required by law or necessary to avert a security risk may take effect immediately; the Customer retains the right of termination in that case as well. We may change, restrict or discontinue free services (free check, Free plan, free tools) at any time; if we intend to discontinue the Free plan as a whole, we terminate the affected accounts in accordance with clause 20.1. For sole traders within the meaning of clause 1.3, the statutory provisions on changes to digital services also apply, to the extent that they are applicable to them.

5.6 Features that must first be set up

Some features require infrastructure that is not available in every case or is switched off by default, such as confirmation by a second, independent check location (clause 10.2), custom domains for client portals (clause 15.2), payment on invoice (clause 19.6) or the partner programme (clause 37). We owe such features only to the extent that they are offered in the account; if the pricing page states such a feature for the plan booked without this reservation, it is owed. Features labelled as beta, preview or trial are provided without warranty and may be withdrawn without notice; clause 29.1 remains unaffected.

5.7 Form protection (formconfirmed)

The form protection under the name formconfirmed is an additional, optional feature. It protects forms on the Customer’s websites against automated submissions without image puzzles: with a proof of work in the visitor’s browser, further signals and, if desired, a check of the message text by a language model. This clause applies only to Customers who switch on the form protection in their account or connect it via the plugin; nothing changes for anyone else.

(a) Service. We provide the script for the form, the issuing of tasks and a verification interface. We assess every submission the Customer’s server presents to us with a score, a recommended action (allow, flag or block) and the reasons. The aim is to make automated submissions laborious and uneconomic. We do not owe that every unwanted submission is recognised and every wanted one allowed; clauses 5.3 and 5.4 apply accordingly.

(b) Customer obligations. The Customer embeds the script and has every submission verified by its server; without this verification the script provides no protection. It keeps the secret key secret, uses the form protection only on its own websites or websites made available to it for use, informs its visitors in its privacy policy (a proposal is provided in the text block for the privacy policy) and decides itself what happens to flagged or blocked submissions.

(c) Quotas and badge. Each plan includes a monthly quota of checks and of content checks as stated on the pricing page. Once it is used up, we do not switch off the protection: checks continue without the content check, and we notify the account holder by e-mail. In the free plan the form shows a small badge “Confirmed by formconfirmed”, which the Customer must not cover or remove; in paid plans it can be switched off.

(d) Outages. If our service is unavailable, verification behaves as the Customer has set for the site: allow and flag submissions (default) or block them. The choice and its consequences lie with the Customer; otherwise the general rules of these Terms on availability apply.

(e) Visitor data. The Customer is the controller for the data of the visitors to its websites; we process it as a processor under the Data Processing Agreement (Annex 1 no. 10). We check the text of a message only if the Customer switches on the content check, and we do not store it.

(f) End. The Customer may pause the form protection or delete the site at any time. After that our interface issues no further tasks for its keys and answers verifications with an error; the Customer removes an embedded script itself.

6. The free check without an account

6.1 Scope

Anyone can have a domain checked on the home page. The free check is always passive: the Service fetches a few public pages as a visitor would, looks for the contact forms and evaluates the recognisable protection measures. It submits nothing and signs in nowhere. The report shows the core checks with instructions for fixing and, of the other checks, gives only their names and number, without results.

6.2 Limits and protection against abuse

An input field that triggers requests to any third-party website can be abused. Limits therefore apply, in particular one check per domain within a certain period, a maximum number of checks per IP address and per session, a daily overall limit, a minimum age for newly registered domains and a check of the target against internal networks. The form is protected by Google reCAPTCHA (details in the Privacy Policy). We record conspicuous patterns and may block the addresses concerned until the matter is clarified. We may change the limits at any time; they are not announced individually.

Automated queries of the input field, circumventing the limits, for example by using changing addresses, and any use of the results to attack websites or harm their operators are prohibited.

6.3 The report

The report is accessible at an address with a random token and is not indexed by search engines. Anyone who knows the address can open it without signing in; anyone who shares it makes the report accessible to everyone who receives it. Reports from the free check are deleted after 30 days.

6.4 Checking third-party websites

The free check also checks websites over which the requesting person has no control. We consider this justifiable because it only fetches what is public anyway, identifies itself as a crawler (/bot), respects a ban in the robots.txt that covers the home page, and submits nothing. Every operator can permanently exclude their domain at /opt-out; an exclusion applies to the domain and its www variant, not to other subdomains, and to all checks of the Service.

6.5 Other free tools

This clause and clause 23 apply accordingly to freely accessible tools such as the rating of a website’s security headers.

6.6 No entitlement

There is no entitlement to the free check or to a free tool. We may restrict them, switch them off temporarily or exclude individual users, in particular if there are indications of abuse.

7. Domains, proof of control and trust levels

7.1 Only own or authorised domains

The Customer adds to their account only domains whose website they operate themselves or for which the operator has engaged them to carry out the check (“authorised”). Agencies and other service providers prove the operator’s engagement on request. Until proof of control is provided, domains without proof are treated in the same way as the free check: they are checked only passively.

7.2 Proof of control

Active checks, monitoring and all features that act into a website or fetch it regularly require the Customer to prove their authority over the domain. For this purpose, the Service offers:

• a TXT record in the domain’s DNS with a value that we specify;
• a meta tag in the head of the home page;
• a file with specified content in the root directory of the website;
• the connection via the WordPress plugin or the TYPO3 extension, which output the meta tag themselves and are bound by a secret known only to the website;
• an agency’s rollout code (clause 15.4), which connects an extension to an account without signing in through the browser.

Anyone who can provide such proof can control the website. That is why we require it instead of asking for a ticked box: anyone can give an assurance, but only someone with access can create a DNS record or place a file on the server.

7.3 What proof of control does

By providing proof of control, the Customer declares that they are entitled to control the domain and instructs us to check the website to the extent provided for by their plan and settings, including the active checks under clause 8.2 and the further checks under clause 8.3 at the frequency of their plan. The Customer may restrict this instruction at any time by switching off monitoring for the domain, or end it by removing the domain.

The proof of control is currently not re-checked after verification. The Customer cannot change the hostname of a verified domain; a different domain must be added separately and verified. If its basis no longer exists, for example because the DNS record has been removed or the extension uninstalled, the domain remains verified; the Customer then removes it under clause 7.4 if their authority has ended.

7.4 End of authorisation

If the Customer’s authorisation for a domain ends, for example because an agency engagement ends or the website is sold, the Customer removes the domain from their account without undue delay. Until then, the Customer is responsible for ensuring that checks of this domain are covered by an engagement.

7.5 Exclusion and robots.txt also apply to Customers

If a domain has been excluded via /opt-out, the Service does not check it, not even for a Customer with proof of control; ongoing monitoring ends with the next scheduled check. Because an exclusion can be registered without proof, it may also have been requested by an unauthorised person. Only we can lift it: the Customer contacts us and proves their authority; we lift the exclusion after checking. The crawler respects a ban in the website’s robots.txt that covers the home page, even for verified domains; it does not respect bans on individual subpaths one by one. Anyone who wants their site checked allows the crawler with the identifier FormExposedBot.

8. Passive and active checks

8.1 Passive check

In a passive check, the crawler fetches a limited number of public pages of the domain one after the other in an isolated browser (currently at most eight, preferably contact, imprint and support pages; plus up to three pages after a click on “Reject” in the cookie banner and up to three pages in a phone view), detects the forms and classifies them by purpose. It evaluates the form structure (field names, types, labels, required and visibility attributes, no values; it reads the beginnings of pre-filled hidden fields and of data attributes only during the check and does not store them), protection measures, embedded third-party scripts, the behaviour after “Reject” in the cookie banner and the display on a phone, and takes screenshots of the home page and of the forms. These screenshots show the page as it was; they are not redacted. The crawler identifies itself with its identifier, respects a ban in the robots.txt that covers the home page, does not follow redirects into private networks and submits nothing.

8.2 Active check with test submissions

For verified domains, every check from the account and every recurring check is an active check. In it, the Service sends at most five test submissions per check through one detected contact form. They show whether the form accepts submissions without a browser, with a filled trap field, with a manipulated token, with an invented CAPTCHA token, with an address under the non-existent ending .invalid or in rapid succession, and whether it lets line breaks through into header lines. For this last probe, the Service uses only a harmless header line of its own and never a real recipient.

Every test submission is labelled as an automated test in its sender, subject and text, in the language of the website, with a reference to /bot, /opt-out and a check identifier. It contains no personal data.

What is never submitted. The Service submits only if it has recognised a form with high confidence as a general contact form. It never submits order, booking, reservation, quotation, appointment, callback, login, registration, password, newsletter, support, payment or upload forms, nor forms with mandatory fields for real personal or company data, nor forms on domains of public authorities, healthcare and educational institutions. If the classification is uncertain, no submission is made. Forms that were classified not by the detection rules but only by the language model are never submitted; they also do not count towards the score and the level.

8.3 Further checks for verified domains

For verified domains, the check additionally includes, depending on the plan:

• fetching a fixed list of known paths under which accidentally exposed files may be found (such as version control directories, configuration and backup files, database dumps, logs); only whether such a file is reachable is recorded, not its content;
• reading publicly recognisable versions of the CMS, plugins and theme and comparing them against a public database of known security vulnerabilities;
• querying public blocklists with the sending IP address of the form e-mail, the IP address of the web server and the domain.

These checks attack nothing and change nothing. The Service shows findings about exposed files and security vulnerabilities only in the account, never in a public report, because they would give attackers a target list.

8.4 Consequences for the Customer

Test submissions are real submissions. On the Customer’s side, they may trigger e-mails, automatic replies, entries in enquiry or CRM systems, notifications, counts in statistics and costs at third parties, for example at a CAPTCHA or mail service. With a daily check, this happens daily. The Customer

• ensures that the recipients of the form e-mails know that such tests take place and that nobody is adversely affected by them;
• sets up filters that recognise labelled test submissions, where necessary;
• reduces the check frequency or switches off monitoring for a domain if they want fewer or no test submissions for a period; there is no separate switch for test submissions alone; a maintenance window (clause 9.4) mutes alerts and pauses the pulse and browser journeys, but does not stop recurring checks, including test submissions;
• bears the costs that test submissions trigger in their own systems and at their service providers.

We are not liable for the consequences of properly labelled test submissions within the scope of this clause; clause 29.1 remains unaffected.

8.5 Limits of the active check

Forms with an effective CAPTCHA can only be actively checked from the outside to a limited extent, because the Service neither solves nor circumvents CAPTCHAs. The Service does not currently offer a bypass for our tests at the Customer’s CAPTCHA. Multi-step forms are made visible for reading; whether their last step can be submitted may remain open. An active check shows how a form responded to the probes. It does not prove that a message reached the recipient; that is what the delivery check is for (clause 11).

9. Monitoring, alerts and incidents

9.1 Recurring checks

For verified domains with monitoring switched on, the Service schedules checks at the frequency of the plan (the pricing page is authoritative), with a random spread so that not all checks run at the same time. In addition, the Customer can start a check manually; a waiting time per domain applies to this. Check intervals are target intervals: maintenance, queues and blocks by the target site may extend them.

9.2 Watchers

Depending on the plan, the Service additionally monitors:

• the form pulse: at short intervals, a simple request without a browser and without a submission to see whether the form page responds, whether the form is still in the source code and whether the CAPTCHA script is reachable;
• the mail settings in the DNS (SPF, DMARC, MX), the TLS certificate of the form page and the expiry of the domain, to the extent that the registry discloses it publicly;
• the status pages of common CAPTCHA and mail providers, to the extent that the Customer uses them according to the check result;
• the versions of form, CAPTCHA and mail plugins reported via the extensions and their comparison with known security vulnerabilities;
• radio silence, when a website that normally receives enquiries no longer receives any, as well as changes to scripts, to the appearance of the form and to third-party providers on the form page.

9.3 Alerts

Alerts go to the destinations the Customer sets up: e-mail and, depending on the plan, signed webhook, Slack, Microsoft Teams, Discord, Google Chat and Telegram, immediately or bundled. An alert is sent only when something changes, not after every check. Its language follows the language setting of the owner of the workspace.

If the Customer chooses a chat service or a webhook, we transmit the alert message (domain, event, link; for check alerts, the link to the report, through which results and screenshots can be accessed without signing in) to that service on the Customer’s instructions. The Customer is then responsible for the choice of the service, its terms and the security of the address provided. Telegram is likewise a destination chosen by the Customer; we send the message there via our own bot. This choice, too, is the Customer’s instruction; how Telegram is to be classified under data protection law in this context, and the fact that the basis for the transfer to a third country has not yet been conclusively clarified, are governed by the DPA. Some of these services process data outside the European Economic Area. Our service is performed when the message is sent. Whether and when a third-party service delivers it is beyond our control.

9.4 Maintenance windows, acknowledgement and escalation

The Customer can set a maintenance window for a domain; the WordPress extension reports an activated maintenance mode itself. During this time, alerts are muted and the pulse and browser journeys are paused; scheduled checks, including test submissions, continue to run. A problem report becomes an incident, which the recipients can acknowledge via a link; if it remains unacknowledged, an escalation can go to destinations set up specifically for this purpose.

9.5 No alert is not an all-clear

The absence of an alert does not mean that everything is in order. An alert may fail to arrive because the state is unchanged, because a check did not complete due to a block by the target site, because a destination was unreachable, because a maintenance window was running or because the Service itself was disrupted. The Customer sees the status of each domain on its page in the account. The Service supplements the Customer’s own attention to their website; it does not replace it.

10. Browser journeys and scan behind the login

10.1 Browser journeys

In paid plans, the Customer can define individual form journeys for verified domains: the address of a form, its selector, preceding clicks and simple check steps. The Service runs through these journeys regularly in a check browser (Chromium, optionally WebKit as well) and measures whether the form appears and can be operated. A browser journey ends before submission: it does not trigger an order, a payment or a submission. The WordPress extension offers signed-in administrators a recorder that records such journeys without reading input values.

The Customer defines only journeys whose execution triggers nothing they do not want. A journey that orders, books or deletes something on a website with a click does not belong in a browser journey.

10.2 Independent second location

The Service can have a reported outage cross-checked from a second, independent location before an alert. This confirmation is switched off by default and is available only if such a location has been set up; the domain page shows whether this is the case. The second location receives the domain, the cleaned configuration of the journey and a job identifier, never login credentials, screenshots or visitor input. Without a location set up, there is no confirmation by a second location.

10.3 Scan behind the login

In paid plans, the owner or an admin of a workspace can store a test account for a verified domain, which the crawler uses to sign in to the website and read the forms on a few pages behind the login specified by the Customer. The test account is used only in the full check, not in the browser journeys under clause 10.1. The following applies:

• Read only. Behind the login, the crawler submits nothing, carries out no active check, takes no screenshots, does not call addresses for signing out, deleting or cancelling and does not circumvent CAPTCHAs.
• Encrypted. The user name and password are transmitted over an encrypted connection and, on our web server, immediately encrypted on storage with a public key of the scan server. Only the scan server can decrypt them, and only for the duration of a check job; the web server, the database and the backups contain them only in encrypted form. They are never displayed, never logged and never released via the API.
• Deletable. The Customer can delete the test account at any time; it is also deleted together with the domain.

10.4 Obligations regarding the test account

The Customer stores only a test account created specifically for this check, with the lowest privileges needed to reach the forms. The Customer never stores the login credentials of a real person, an administrator, a customer of their website or another service, nor any password they use elsewhere. The Customer confirms this expressly during setup. The Customer ensures that the test account cannot view any data of real persons and changes or deletes it as soon as they no longer use the feature. This feature is the only case in which the Service uses login credentials for a website of the Customer; it does not change the fact that we receive no access to the Customer’s systems (clause 12.3).

11. Delivery check and authenticity of the form e-mail

11.1 How it works

In the plans for which the pricing page provides for it, the Customer can enter a control address provided by us as a blind copy (BCC) in the notification of their form for a verified domain. After an accepted test submission (clause 8.2), its copy must arrive in our control mailbox within a few hours; otherwise, the Service reports that delivery failed. From the incoming copies, the Service also checks SPF, DKIM and DMARC of the form e-mail and reports if they fail.

11.2 What reaches us in the process

A blind copy is sent to us not only for our test submission, but for every submission through the form, that is, also for real enquiries from visitors to the website, with their content. The automatic retrieval reads only the header lines and at most the first 8 KB of the text in order to assign the e-mail to a domain and, where applicable, to a test, and to carry out the authenticity check. Only the time, the assignment, where applicable the test identifier and the result of the authenticity check are stored. This result may contain the IP address of the sending mail server and, if it does not belong to the website, the domain of the sender address; only then may an alert name this domain; we do not store the content or the complete sender addresses of visitors. After successful processing, the e-mail is deleted from the mailbox. If a retrieval or a deletion fails, it may remain in the mailbox until the next successful run.

For the copies of real enquiries, we are the Customer’s processor; the DPA applies. The Customer informs the visitors to their website about this data flow, for example with the Privacy Policy Text for Your Website, and does not set up the feature for forms through which special categories of personal data (Art. 9 GDPR) are transmitted.

11.3 What it proves – and what it does not

A matching receipt proves only that the copy of our test submission arrived in our control mailbox. It does not prove that the e-mail reached the actual recipient, is not sitting in a spam folder there or was transferred into a CRM system. The Service does not offer confirmation via the interface of a CRM provider (such as HubSpot). Without a control address entered, the delivery check is not available.

12. Fix it for me, protection components and AI

12.1 Instructions and protection components

For the findings, the Service shows instructions for fixing them on common systems. In paid plans, it generates protection components for custom form code (currently for PHP, Node.js and Python) using the field names from the last check, which implement the same protection measures that the check expects. For WordPress forms, the extension comes with a ready-made protection layer (clause 13.2).

12.2 Adaptation with a language model

On request, the Customer pastes in their form code, and a language model builds the protection component into it. What comes back is the modified file, a patch, the result of a syntax check and a check of whether the protection measure has actually been built in. The following applies:

• The language model runs on our own scan server in Poland. The pasted code is not sent to any language model provider and is not stored after the response.
• The number of requests per workspace and day is limited; the interface states the limit.
• Output from a language model may be wrong, incomplete or insecure, even if the automatic check considers it good. It is labelled as generated. How we use AI is described on the EU AI Act page.

12.3 No access to the Customer’s systems

“Fix it for me” works without login credentials. We do not request or use FTP, SSH, hosting or administrator access, do not install anything on the Customer’s servers and do not change anything on their website. The Customer builds in, tests and publishes the code themselves.

12.4 Review by the Customer

The Customer does not paste any login credentials, keys, passwords or personal data into the input field. Before building in the code, the Customer backs up their website and data, reviews generated or modified code, tests it in a test environment and only then deploys it. The Customer is responsible for operating modified code on their website.

13. WordPress plugin, TYPO3 and MainWP extensions

13.1 Licence

The WordPress plugin, the MainWP extension and the TYPO3 extension are free software under the GNU General Public License, version 2 or (at your option) any later version. What the Customer may do with their code is determined solely by this licence; these Terms do not restrict it. The Terms apply to the connection of the extensions with the Service and to everything the Service provides in response to their requests.

13.2 What the extensions do

WordPress plugin. It starts a passive check of the Customer’s own website, shows the result in the WordPress admin area and comes with a protection layer for common form plugins, comments and registrations (trap field, signed minimum completion time, proof of interaction, invisible proof-of-work puzzle instead of CAPTCHA, throttling, check of header lines and mail domain, filters). The protection layer runs exclusively on the Customer’s server, is free for everyone, without an account and without a plan; if the plugin is connected to an account, it sends us daily figures, the plugin inventory and, for swarm protection, the domains of links from blocked messages (clauses 13.3 and 13.5). Anyone who has switched it on keeps it even when a plan ends.

TYPO3 extension. It starts a passive check from the TYPO3 backend, outputs the meta tag for proof of control and, when connected, counts accepted submissions and submissions stopped by Powermail, mail errors and updates. It does not come with a protection layer of its own; it does not change the behaviour of Powermail.

MainWP extension. It shows the results of all websites from the Customer’s account in a MainWP dashboard. It requires an API key (clause 16.1), stores it in the Customer’s dashboard and sends it only to formexposed.

All three extensions are free of charge. Features that are only available with an account or a paid plan are listed on the pricing page.

13.3 Connection with an account

If the Customer connects an extension with their account, it transmits figures and characteristics to the Service, but, apart from the link domains of swarm protection (clause 13.5), never form content, e-mail addresses, names or IP addresses of visitors: daily, the number of blocked and accepted submissions per reason, mail sending and the type of its errors, figures on reCAPTCHA responses, characteristics of the form settings, figures on stored enquiries and retention periods, the versions of a fixed list of form, CAPTCHA and mail plugins and, promptly, updates and activations of plugins, themes and WordPress. Exactly which data are transmitted is described in the Privacy Policy and the description of the respective extension. Optional counts of form events and field errors are switched off by default.

13.4 What happens on the Customer’s website

Installation, updates, backups and settings of the extensions are the Customer’s responsibility. This applies in particular to features that process or delete visitor data on their website:

• The quarantine keeps stopped submissions on the Customer’s server for 14 days; the safety net keeps form e-mails that could not be sent for 30 days. Both remain on the Customer’s website and are not sent to us.
• The retention periods, if the Customer switches them on, permanently delete stored enquiries in form plugins after the chosen period. Before switching them on, the Customer checks whether they must keep these enquiries for other reasons.
• The switch from reCAPTCHA to the proof-of-work puzzle and other one-click changes to form plugins change their settings; the extension creates a backup for this and offers a way back.
• Filters (for example for disposable addresses, writing systems, blocked words, countries) can stop real enquiries. Stopped enquiries end up in quarantine.

The Customer informs the visitors to their website about this processing themselves; the WordPress extension suggests paragraphs of text for this. The Customer alone is responsible for the data that remain on their website.

13.5 Swarm protection

If swarm protection is switched on (on by default, can be switched off at any time), the extension reports the domains of links from stopped messages, never messages, senders or visitor IP addresses. If a domain appears frequently on several websites, the Service distributes it as a blocklist to all connected websites with swarm protection switched on. Large services and our Customers’ domains are never listed. The Customer permits us to use the link domains reported by their website in this way; no IP addresses are transmitted for this purpose.

13.6 Updates and minimum versions

We continue to develop the extensions and fix bugs and security vulnerabilities in new versions. We may exclude older versions from connecting to the Service if they pose a security risk; this already happened once in 2026, when a vulnerability in the connection process was closed. The Customer keeps the extensions up to date.

14. Badge, evidence log and reports

14.1 The badge

For verified domains, the Customer can embed a badge on their website that is linked to a public confirmation page. The badge shows “protected” only while the domain is verified, monitoring is running and the last completed check is no more than 45 days old and resulted in “Protected” or “Partially protected”; otherwise, it shows a neutral state. It does not name any findings.

The Customer embeds the badge unchanged and only on the website of the domain for which it was issued. The Customer does not use it to create an impression that goes beyond what it states, in particular not that of a certification or a guarantee against spam (clause 5.4). When the badge is loaded, the visitor’s browser transmits its IP address, the address of the page and browser details to our server; we do not set a cookie in the process. The Customer informs their visitors about this.

14.2 Evidence log and timestamp

In the plans for which the pricing page provides for it, the Service creates an evidence log with a reference number for each domain and month: what was checked, with what result, what was reported and what changed. Under the reference number, a public page confirms the domain, period and key figures, without details. For each version, to the extent this function is switched on, the Service has a checksum of the log signed by a time-stamping authority under RFC 3161; only the checksum is sent to the time-stamping authority. This timestamp is not a qualified electronic time stamp within the meaning of Regulation (EU) No 910/2014 (eIDAS). The mapping to NIS2, DIN SPEC 27076, ISO/IEC 27001, the GDPR or PCI DSS is for guidance only; it does not certify compliance.

14.3 Notes on data protection, accessibility and scripts

In separate blocks, the Service shows technical notes that do not count towards the protection score: whether a CAPTCHA loads before consent, whether there is a privacy link at the form, which third-party scripts and advertising pixels run on the form page, whether input is sent to session recording services, whether the form meets accessibility requirements that can be checked automatically and, for verified domains, an inventory of the scripts with checksums. From the last check result, it can generate a draft of accessibility information that asserts only what was measured. The Customer reviews, supplements and takes responsibility for any such text before publishing it. These notes and drafts are not legal advice (clause 5.4).

14.4 Monthly report and value figures

The Service can send the Customer a monthly report; it can be switched off in the settings. Statements such as “stopped spam corresponds to this much working time” or “better protected than a certain share of the sites checked” are estimates based on stated assumptions and on totals from many checks; they are not a promise of any benefit.

15. Features for agencies

15.1 Use for third-party websites

An agency, a freelancer or a hosting provider may use the Service for its clients’ websites if it has been engaged to do so (clause 7.1). It remains our sole contractual partner and is responsible for compliance with these Terms, including in relation to its clients. It ensures that its clients know about active checks, the delivery check and the transmissions of the extensions and, where necessary, that a data processing agreement exists between it and them that entitles it to give us corresponding instructions.

15.2 White-label reports and custom domain

On the Business plan, the Customer can issue reports under their own brand (company name, logo, colour, contact line, note to the client). Such reports name us only if the Customer switches on the reference to us. The Customer is solely responsible for all statements they make in them, in the client portal or otherwise towards their clients; they are the Customer’s statements, not ours. The Customer uses only trademarks and logos that they are entitled to use. When the Business plan ends, white-label reports are no longer accessible. A custom domain for the portal and reports is available only to the extent that the Service offers it; the Customer sets up the necessary DNS records themselves.

15.3 Client portal

On the Business plan, the Customer can create a portal under their own brand for their clients, optionally password-protected. There, their clients can subscribe to a monthly report by e-mail; the subscription takes effect only after confirmation via a link in an e-mail (double opt-in) and can be cancelled with one click. The Customer is the controller for the subscribers’ data, and we are the Customer’s processor (DPA). We send only to subscribers who have signed up and confirmed themselves. The Customer does not sign anyone up without their knowledge.

15.4 Rollout codes and import

With a rollout code, the Customer connects many websites with an extension to their account in one go; the code acts as proof of control (clause 7.2). The Customer uses it only on websites for which they are authorised, keeps it secret and revokes it when it is no longer needed. When importing many domains, clause 7.1 applies to each one individually.

15.5 Prospect check

On the Business plan, the Customer can have a prospect’s website checked passively, within a monthly quota stated in the interface. The result is a short summary of findings under the Customer’s brand at an address with a random token. An exclusion via /opt-out also applies here. We do not write to the prospect or send them anything; only the Customer passes on the link.

The following applies, and we point it out expressly: anyone who sends a business that has not consented an unsolicited e-mail, message or call with a summary of findings and an offer is engaging in direct marketing. In Poland, Art. 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej, “PKE”) requires the recipient’s prior consent for this, including between businesses; in Germany, § 7(2) of the Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG) applies correspondingly. The Customer uses the prospect check only within the framework of these and all other applicable rules on advertising and approaching people, for example in a conversation with a prospect who has contacted the Customer themselves. The Customer presents the findings objectively, without exaggeration or threats, and bears sole responsibility for how they approach prospects. If the Customer breaches this, clause 30 applies.

16. API, MCP and automations

16.1 REST API

On the Business plan, the Service provides a REST API with which the Customer can add and query domains, start checks and retrieve results, incidents and checks. The Customer obtains access with API keys generated in the account; their number and the number of requests per minute are limited. A key is displayed only once and stored by us only as a checksum; lost keys can be replaced, not recovered. The rights of a key correspond to those of its holder in the interface.

16.2 MCP server

Via an MCP server (Model Context Protocol), the Customer can use the same key to let an AI assistant of their choice access their data: read domains, checks and incidents, have a check explained and start a check. What the assistant does with the retrieved data, with which provider it runs and where it transfers them is determined by the Customer; this provider is neither our sub-processor nor our vicarious agent. Decisions that such an assistant makes or proposes on the basis of the data are the Customer’s decisions.

16.3 Zapier, Make, n8n and deployment pipelines

For automation services, the Service provides connections and templates to the extent that they have been published: templates for Zapier and Make, templates for n8n and templates for GitHub Actions and GitLab CI that trigger a passive re-check after a deployment. Such a service is not part of the Service. The Customer switches it on, concludes a separate contract with its provider and is responsible for the transmission to it. If a provider changes its interface or terms, a connection may stop working; there is no entitlement to its continuation.

16.4 Limits of use

The interfaces may be used only with the Customer’s own keys, within the documented limits and not to circumvent plan limits, waiting times or the checks under clause 7. Keys must be kept secret; anyone who suspects that a key has become known revokes it in the account.

17. Account, workspaces, roles and team

17.1 Workspaces and roles

Domains belong to a workspace, not to a person. Depending on the plan, an account can have several workspaces; agencies, for example, create one per client. The Service has three roles: the owner holds the workspace and is our contractual partner for it; the plan and limits of the workspace are determined by the owner’s account. An admin may manage domains, alert destinations and settings and invite members; only the owner can change roles and remove members. A viewer may read. The roles are enforced on our servers, not only in the interface.

17.2 Team

The Customer invites further persons to a workspace by e-mail; they become members when they accept the invitation. Each person uses their own login. Accepting an invitation does not create a further contract between the invited person and us for this workspace; the owner’s contract applies to it. The members of a workspace see the name, e-mail address and role of the other members. A member can be removed by the owner; their own account remains unaffected.

17.3 The Customer is responsible for their members

The Customer is responsible for the acts and omissions of their members and of every person acting with login credentials, API keys, rollout codes or extension secrets issued under their account as if they were the Customer’s own. This also applies to persons whose access was not withdrawn in time.

17.4 Login credentials and account security

The Customer keeps passwords, API keys, rollout codes and the secrets of the extensions secret, does not share them and withdraws access when a person leaves. We recommend the two-factor sign-in offered by the Service. The Customer notifies us without undue delay of any suspected unauthorised access. We never ask for passwords by e-mail.

17.5 View by support

To handle a support request, we can view an account as the Customer sees it. Every such access is logged and visible in the Customer’s data export. It ends after one hour at the latest. During the view, anything that changes the account itself is blocked, such as password, e-mail address, second factor, subscription, export, deletion and handover.

17.6 Deleting the account

The Customer can delete their account at any time in the settings. The following applies, and the interface points this out before deletion:

• A running paid subscription ends immediately. We do not refund anything for the remainder of a period already paid for. Anyone who wants to use up the paid period cancels first (clause 20.2) and deletes the account afterwards. Exceptions: for sole traders within the meaning of clause 1.3, we refund on request the part of the fee attributable to the period after deletion; if, before deletion, the Customer declared a switch or the deletion of their data under clause 20.3, we refund pro rata for the period after the day on which the subscription would have ended under clause 20.3; the right of withdrawal (clause 36) remains unaffected.
• Workspaces of which the Customer is the owner and in which other members work pass to one of these members, admins first. A team’s work should not disappear because the person who happened to create the workspace leaves. The transferred workspace is then subject to the plan and limits of the new owner. The member who becomes owner has accepted these Terms with their own account; the workspace falls under that member’s contract with us, without this giving rise to any payment obligation for them. Anyone who does not want this removes the members or the domains before deleting.
• Workspaces without other members are deleted together with their domains and the data of these domains.
• The deletion is final and cannot be undone. What is still retained afterwards is set out in clause 21.3.

18. Plans, limits and fair use

18.1 The plan determines what is owed

Every plan has limits, for example on the number of domains, workspaces and members, the frequency of recurring checks and of the form pulse, and the available alert channels and features. The limits and features stated on the pricing page at the time of the order are authoritative. We deliberately do not write them into these Terms because they change more often than the rules of this contract; a change to the detriment of a running paid plan is dealt with in clause 5.5. Domains and members are counted per account across all workspaces of which it is the owner.

18.2 What happens at a limit

When a limit is reached, the Service does not allow anything further to be added; what exists remains. If an account exceeds a limit after a downgrade or a handover, it keeps its domains and members but cannot add any more until it is below the limit again; frequencies and features follow the new plan. Monitoring usage is the Customer’s responsibility.

18.3 The Free plan

The Free plan is free of charge. Its report shows the core checks; it names the other available checks only by name and number. Limited liability applies to free services (clause 29.3).

18.4 Fair use

The Service runs on shared infrastructure. The Customer does not load it to an extent that is disproportionate to their plan, in particular not by querying the interfaces beyond the documented limits, by repeatedly adding and removing domains to circumvent limits or waiting times, or by creating several accounts for this purpose. If a Customer’s use materially impairs the Service for others, we may throttle it and inform the Customer of the reason and the remedy. Blocking happens only if throttling is not sufficient; clause 31 then applies.

18.5 Abuse prevention

The Service automatically rejects requests with abuse patterns and may block addresses temporarily. These measures protect the Service and third parties and take effect before any contractual assessment. If a measure affects the Customer’s legitimate use, we lift it without undue delay after being notified. Their operation is not a defect of the Service.

19. Fees, taxes and payment

19.1 Fees

The fees stated on the pricing page for the plan, billing period and currency at the time of the order apply. The Service offers the currencies euro and złoty; the currency chosen when ordering is authoritative, and we owe no conversion. Fees are payable in advance for the entire billing period.

19.2 Payment service provider

Payment is processed by Stripe. The Customer enters payment details on Stripe’s pages; we do not receive or store them. Stripe’s terms also apply in the relationship between the Customer and Stripe. The Customer manages payment methods, billing details and invoices in the Billing area via the Stripe customer portal. If the payment service provider is unavailable, we may temporarily not accept new orders.

19.3 Taxes and reverse charge

Fees are exclusive of statutory VAT, where applicable. If the Customer is established in another member state of the European Union and provides a VAT ID that is valid at the time of the supply, the Customer owes the tax under the reverse-charge procedure if the statutory requirements for this are actually met. The Customer is responsible for the accuracy and validity of their VAT ID. If it proves invalid, the Customer reimburses us for the tax, plus interest, imposed on us as a result.

19.4 Trial period

If the pricing page offers a trial period (currently 14 days), it applies once per account and only to the first order of a paid plan. It can be started without providing a payment method. We remind the Customer by e-mail three days before it ends. If the Customer has stored a payment method by the end, the subscription continues on a paid basis; if not, it ends automatically without an invoice being issued, and the account continues on the Free plan. There is no entitlement to a trial period.

19.5 Monthly and annual subscription, renewal

Paid plans are available with monthly and with annual billing. An annual subscription is paid for twelve months in advance as a total amount; a monthly comparison shown on the pricing page is not a monthly charge. Subscriptions renew for a period of the same length unless cancelled before the end of the current period (clause 20.2).

19.6 Payment on invoice

If payment of an annual subscription on invoice is offered, the Customer provides their company name, address and, where applicable, VAT ID for this; Stripe issues the invoice, and the Customer transfers the amount within the period stated on the invoice. There is no entitlement to payment on invoice.

19.7 Activation codes and discounts

A hosting provider, a partner or we ourselves may issue codes that unlock a plan for a certain number of months without payment. Each account can redeem a code from a campaign once. We remind the Customer one week before an activation ends; after that, the plan the Customer booked themselves applies again, otherwise the Free plan. Discounts and vouchers apply only to the extent shown at checkout.

19.8 Price changes

We may change the fees for future billing periods. We announce an increase for a running subscription by e-mail at least 30 days before it takes effect. It applies at the earliest from the first billing period that begins after this notice period has expired; it never applies to a period already paid for. The Customer may cancel the subscription until the increase takes effect, as of the end of the current period. The notice states the new fee, the date on which it takes effect and this right of cancellation. Price reductions and changes for new orders apply without notice. If the statutory VAT rate changes, the amount of tax changes accordingly; this is not a price change within the meaning of this clause.

19.9 Failed payment and default

If a payment fails, Stripe makes further attempts, and we notify the Customer by e-mail at the first and at the last attempt. If payment is still not made after that, we may end the subscription; as a rule, this happens automatically with the last unsuccessful attempt. The account then continues on the Free plan; clause 18.2 applies. For the period in which the paid plan could be used despite the outstanding payment, the pro rata fee remains due.

If the Polish Act of 8 March 2013 on Counteracting Excessive Delays in Commercial Transactions (ustawa o przeciwdziałaniu nadmiernym opóźnieniom w transakcjach handlowych) applies to the Customer, we may, from the day after the due date, claim the statutory interest for late payment in commercial transactions (Art. 7 of that Act) and, without any reminder being required, compensation for recovery costs under Art. 10 of that Act: 40 euros for a claim of up to 5,000 złoty, 70 euros for a claim of more than 5,000 and less than 50,000 złoty, and 100 euros for a claim of 50,000 złoty or more, converted into złoty at the average euro exchange rate of Narodowy Bank Polski on the last working day of the month preceding the month in which the claim became due. Further reasonable recovery costs remain reserved (Art. 10(2) of that Act). If that Act does not apply to the Customer, the Customer owes the statutory default interest under Art. 481 KC.

19.10 Invoices and objections

We issue invoices electronically, in the form prescribed by tax law; to businesses in Poland, where required, via the National e-Invoicing System (KSeF); otherwise, the Customer agrees to electronic transmission. They are available in the Billing area. The Customer should raise objections to an invoice within 30 days of its date in text form, stating the reason, so that the matter can still be clarified. Statutory periods remain unaffected.

19.11 Refunds and set-off

We refund fees paid only to the extent provided for in these Terms (in particular clauses 5.5, 17.6, 20.3, 20.5, 24.2, 32, 34, 36 and 38.1) or required by mandatory law. There is no refund for periods in which the Customer did not use the Service or for unused capacity within a plan. The Customer may set off only claims that are undisputed or have been finally established by a court; this restriction does not apply to sole traders within the meaning of clause 1.3.

20. Term, termination and change of plan

20.1 Account and Free plan

The contract for the account runs for an indefinite period. The Customer can end it at any time by deleting their account (clause 17.6). We may terminate it with 30 days’ notice in text form; if a paid subscription is running, our termination takes effect no earlier than the end of the paid period. In relation to sole traders within the meaning of clause 1.3, we terminate under this clause and under clause 20.2 only for one of the following reasons, which we state in the termination: discontinuation of the Service or of the plan concerned as a whole, a change in the legal situation or requirements of authorities that make further provision unreasonable, the discontinuation of a third-party service necessary for provision, or the account not having been used for at least twelve months.

20.2 Paid plans

Paid plans run for the chosen billing period and renew under clause 19.5. The Customer can cancel at any time in the Billing area as of the end of the current period; until then, the plan remains usable, and until then the Customer can also withdraw the cancellation. After that, the account continues on the Free plan. We may terminate a paid subscription with 30 days’ notice as of the end of a billing period.

20.3 Switching provider and exporting the data (Data Act)

Regulation (EU) 2023/2854 (Data Act) gives customers of data processing services the right to switch to another provider or to their own systems, or to export their data and have it erased (Art. 23 et seq.). We apply the following rules regardless of whether formexposed is a data processing service within the meaning of Art. 2(8). They contain the contractual provisions under Art. 25(2) and, in the event of a switch, take precedence over the other provisions of these Terms.

1. Switching request and notice period (Art. 25(2)(d)). The Customer declares in text form or via the support window that they want to switch to another provider or to their own systems, or to have their data exported and erased. They do not have to give a reason. A paid subscription ends at the time stated by the Customer, but no later than two months after receipt of the declaration, even if the paid period runs longer; we refund fees paid in advance for the period thereafter on a pro rata basis. Until the subscription ends, the plan remains usable with all its features. We confirm the end of the subscription in text form.
2. Transition period (point (a)). In the event of a switch, the end of the notice period is followed by a transition period of no more than 30 calendar days in which the switch is completed; it ends earlier as soon as the Customer informs us that the switch has been completed. During this time, the contract continues to apply, and the previous plan remains usable with all its features and export routes; we do not charge a fee for this. We assist the Customer and the third parties designated by them with the switch to a reasonable extent, continue to provide the services with due care so that the Customer’s business can continue as far as possible without interruption, provide clear information about risks to the continuity of the service known to us, and maintain the level of security of the Technical and Organisational Measures, including for the data during the transfer.
3. Different transition period (Art. 25(4) and (5)). If the transition period of 30 calendar days is technically unfeasible, we notify the Customer of this, with reasons, within 14 working days of their switching request and state an alternative transition period of no more than seven months; we provide the services under no. 2 until its end, likewise free of charge. The Customer may extend the transition period once by a period they consider more appropriate; for the period of the extension, they pay the ordinary fee for their plan pro rata for the actual duration.
4. Exit strategy (point (b)). We provide the Customer with the information they need for their exit strategy, in particular on the export routes, formats and interfaces and their known limitations. It is available on the EU Data Act: Switching and Data Export page.
5. Exportable data (point (e)). The exportable data are all data that the Customer and their members have entered into the Service or that have been generated by their use of the Service for their workspaces and domains, with the exception of those listed in no. 6, namely: account and profile data; workspaces and memberships; domains with their settings; monitored forms and form journeys with their check steps; alert destinations; brand; client portals including subscribers; prospect checks; API keys without secret; devices, sign-ins, activities and page views; support requests; e-mails sent; records of consent; check results with findings and screenshots; incidents and alert log; daily figures of the forms and response times; delivery attempts of escalations; script inventory with change log; evidence logs with timestamps; the portfolio overview. We supply them in open, machine-readable formats (JSON, CSV in UTF-8, HTML report, timestamp response under RFC 3161). Which data can be retrieved by which route and in which format is stated on the EU Data Act page; what is supplied there only on request we supply within 30 days; on the Customer’s instructions, we also transmit it directly to the provider to which they are switching. Invoices are provided by Stripe as PDF.
6. Excluded data (point (f)). Exhaustively, the data not exportable are those that serve only the internal operation of the Service and whose disclosure would endanger our trade secrets or the security of the Service: password hashes, two-factor sign-in secrets, tokens and signing keys, the encrypted login credentials of test accounts, the weighting of the score, our detection rules and the notes of our abuse prevention. The right of access under Art. 15 GDPR remains unaffected.
7. Retrieval period (point (g)). After the end of the transition period, the Customer can retrieve their data for at least 30 calendar days; if they chose erasure instead of a switch, no. 8 applies. Unless the Customer requests the termination of the account under no. 8, the account with the data export continues to exist on the Free plan beyond that until they delete it.
8. Completion and erasure (points (c) and (h)). Once the switch has been completed, we confirm this to the Customer in text form; the contract for the paid plan is thereby deemed terminated, unless it has already ended under no. 1. If the Customer has requested that the account also end, the contract for the account ends on expiry of the retrieval period or earlier upon the Customer’s confirmation that the switch has been completed, and immediately thereafter we erase all exportable data and digital assets that were generated directly by the Customer or relate directly to them. If, in their declaration, the Customer chose erasure instead of a switch (Art. 25(3)), the contract for the account ends at the end of the notice period, and we erase these data immediately thereafter. The only exception is what clause 21.3 lists as remaining after deletion, for the periods stated there.
9. Switching charges (point (i)). We charge nothing for the switch, the export of the data or assistance with it (Art. 29). The fee for an extension requested by the Customer under no. 3 is the ordinary fee for the plan used further, not a switching charge.

We currently arrange the early end of the subscription, the refund and provision on request manually after receipt of the declaration. If the EU Data Act page promises the Customer more than this clause, that promise also forms part of this contract.

20.4 Change of plan

The Customer changes the plan in the Billing area. How a change takes effect, whether immediately or at the end of the period, and how amounts already paid are credited is shown at checkout before confirmation. After a downgrade, clause 18.2 applies; features of the previous plan, such as white-label reports, client portals, API access, browser journeys or the scan behind the login, are then no longer available. Stored test accounts (clause 10.3) are then no longer used; the Customer can delete them at any time.

20.5 Termination for good cause

Either party may terminate without notice for good cause. Good cause exists for us in particular if the Customer has domains checked without authorisation, uses the Service contrary to clause 23, uses the prospect check contrary to clause 15.5 or otherwise materially breaches these Terms and does not remedy the breach within a period of at least 14 days that we set for them in text form; no period is required if the breach cannot be remedied or if waiting would seriously endanger us or third parties. Default in payment of more than 30 days despite a reminder in text form is also good cause. Good cause exists for the Customer in particular if we breach an essential contractual obligation (clause 29.2) and do not remedy the breach within a period of at least 14 days that the Customer sets for us in text form.

If a paid subscription ends through termination under this clause, we refund fees paid in advance for the period thereafter on a pro rata basis. If we terminate because of a breach by the Customer, we may set off our claims arising from this breach against the refund.

20.6 Form

Terminations are made in the account or in text form to the addresses in clause 38.5. A message in a chat window is not sufficient; for the switching declaration under clause 20.3, the support window is also sufficient.

21. Consequences of the end of the contract and data export

21.1 Before the end: the data export

The Customer can download their data as a file in the settings at any time. The export includes in particular account and profile data, workspaces and memberships, domains with their settings, form journeys, alert destinations, brand, client portals and their subscribers, prospect checks, API keys (without secrets), sign-in devices, activities, support requests, e-mails sent and the records of consent. Check results are available as reports in the account; evidence logs, the script inventory and the portfolio overview can be downloaded as separate files. Invoices and payment methods are held by Stripe; they are available in the Billing area. Which data are exportable overall and which are not is governed exhaustively by clause 20.3 nos. 5 and 6; this also applies outside a switch of provider. The Customer should export whatever they want to keep before deleting their account; after deletion, there is no archive from which it could be restored.

21.2 End of a paid plan

If a paid plan ends without the account being deleted, the data are retained and the account continues on the Free plan. The limits and features of the Free plan apply (clauses 18.2 and 20.4).

21.3 Deletion of the account and what remains

When the account is deleted, we delete the data in accordance with our Privacy Policy. The following are deliberately retained: the record of consent to these Terms and to the DPA (clause 4.4); entries in the activity log until its period of 365 days expires; entries in the page view log and sent e-mails until their periods of 60 and 30 days expire; support requests for 24 months; reports of prospect checks until their period of up to 90 days expires; invoices and accounting records for the period prescribed by tax law. Database backups expire after 14 days; until then, deleted data may be contained in them. They are used only for restoration after a loss.

If the contract for the account ends other than by the Customer deleting the account, for example through our termination, the Customer can export their data until the end of the contract; no later than 30 days after the end of the contract, we delete the account as in the case of deletion by the Customer. For termination under clause 20.3, no. 8 of that clause applies.

21.4 Periods during the term

Data are also deleted after set periods during the term, for example check results after 13 months (the most recent check of each domain is kept) and the figures transmitted by extensions after 13 months. If a domain is removed, we delete the data of the domain, such as checks, findings, screenshots, reports, alerts, incidents, test accounts and monitored forms. The individual periods are set out in the Privacy Policy and, for data processed on behalf of the Customer, in the DPA.

21.5 Removing extensions and entries

When use ends, the Customer removes badges, control addresses in form notifications, deploy hooks and proof-of-control entries from their websites and uninstalls extensions they no longer want to use. An embedded badge image no longer shows a protected state after the end.

21.6 Survival

Clauses 2, 3, 4.4, 19 (for amounts already due), 20.3 (until a switch and the erasure have been completed), 21, 22, 25, 26, 28, 29, 30, 38 and 39 continue to apply after the end of the contract, as does any other provision whose nature requires it.

22. Obligations and warranties of the Customer

22.1 The division of roles

We provide a tool. The Customer determines which websites are checked, which forms are actively tested, where alerts are sent, which control addresses are entered, which test accounts are stored and which features of the extensions are switched on. We see the Customer’s website as any visitor sees it, not their contracts with their clients and not their privacy policy.

22.2 Warranties

The Customer warrants for the entire term of the contract that

• they operate every domain in their account themselves or have been engaged by the operator to check it (clause 7);
• the recipients of the form e-mails know about active checks and nobody is adversely affected by them (clause 8.4);
• they inform the visitors to their websites about the delivery check, the badge and the features of the extensions, to the extent they use them (clauses 11, 13 and 14);
• a stored test account meets the requirements of clause 10.4;
• they do not enter any third-party login credentials, special categories of personal data (Art. 9 GDPR) or payment card data into input fields of the Service, unless a feature expressly requires it;
• they comply with all rules applicable to them, in particular on data protection, advertising and approaching people, telecommunications and competition.

22.3 Cooperation

The Customer provides the cooperation needed for performance: the Customer provides proof of control, allows the crawler, keeps contact details and alert destinations up to date, answers queries about suspected abuse promptly and reports disruptions they notice. If we are prevented from performing because cooperation was not provided, this is not a defect of the Service.

22.4 The Customer’s own diligence

The Customer regularly backs up their websites and data, reviews changes before deploying them and decides themselves which measures to derive from findings. Decisions the Customer makes on the basis of the results are made after their own review.

23. Acceptable use

The Customer and every person who uses the Service may use the Service only within the bounds of the law and these Terms. In particular, it is prohibited:

• to transmit unlawful content via the Service, to store it in the Service or to distribute it via client portals, white-label reports, logos, trademarks, notes or notice texts;
• to have domains checked for which there is no authorisation, or to obtain proof of control for a third-party domain by deception;
• to use the Service or its results to attack, overload or spy on third-party systems or to access them without authorisation, or to pass on results for this purpose;
• to circumvent limits, waiting times, bot protection, the check of authorisation or security measures, or to query the Service automatically outside the documented interfaces;
• to test the security of the Service without complying with the rules of our vulnerability reporting point, or to subject it to load or penetration tests;
• to alter the badge, to use it outside the domain for which it was issued, or to use it to create the impression of a certification;
• to sign up persons to a client portal without their consent, or to use the prospect check contrary to clause 15.5;
• to resell the Service or offer it as one’s own service, except within the agency features under clause 15;
• to use the Service or its output to develop a competing product, or to reverse engineer the server software, unless mandatory law permits this.

What we understand by abuse, how we detect it and how we respond to it is described on the Acceptable Use and Abuse page; it forms part of this contract. We do not generally monitor use for compliance with this clause and assume no such obligation; if we become aware of a breach, clauses 31 and 33 apply. Our own checks for detecting abuse are exclusively passive; we do not attack third-party websites.

24. Data protection and roles

24.1 Who is responsible for what

We are the controller for the data about the Customer and their members (account, sign-in, billing, support, record of consent), for the use of our websites, for the free check, for our own checks of public pages and for checks of domains in the account for which the Customer has not yet provided proof of control (clause 7). How we process these data is described in the Privacy Policy.

For personal data of third parties that the Customer brings into the Service or allows to enter it through their configuration, the Customer is the controller and we are the Customer’s processor. This includes in particular copies of real form e-mails in the delivery check (clause 11), subscribers to client portals (clause 15.3), login credentials of test accounts (clause 10.3), contact persons in white-label details and personal data that happen to be visible on checked pages of a Customer domain, as soon as the Customer has provided proof of control for that domain. This processing is governed by the Data Processing Agreement. It is concluded with every Customer at registration, even if the Customer does not initially use any such feature, so that it is in place before the first such processing begins.

Whether the roles are different in an individual case depends on the actual processing; the DPA and the Privacy Policy describe them in detail.

24.2 Security and sub-processors

The measures for protecting the data are described in the Technical and Organisational Measures. The Customer grants general authorisation to engage sub-processors. The current list with purpose, types of data and location is available under Sub-processors. We announce a new or replaced sub-processor at least 30 days in advance by e-mail to the address of the account holder and on the sub-processors page. If the Customer objects on objective data protection grounds, we do not use the new sub-processor for the data we process on the Customer’s behalf until a solution is found, or we suspend the feature concerned for them; if we cannot find a solution, the Customer may terminate the contract concerned as provided in the DPA; we refund fees paid in advance for the period thereafter on a pro rata basis. We are liable to the Customer for our sub-processors under Art. 28(4) GDPR.

24.3 Personal data breaches

If we become aware of a personal data breach affecting data processed on behalf of the Customer, we notify the Customer without undue delay, where possible within 48 hours, with the information the Customer needs for their own notification. The details are governed by the DPA.

24.4 Requests from data subjects

If a person contacts us about data for which the Customer is the controller, we refer them to the Customer and inform the Customer, unless the law requires otherwise. For data for which we are the controller, the Access, Erasure and Your Other Rights page applies.

24.5 Data protection contact

Questions about data protection can be sent to us at contact@lukaswojcik.com. No data protection officer has been appointed because, according to our assessment, we are not obliged to appoint one (Art. 37(1) GDPR). The competent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Moniuszki 1A, 00-014 Warszawa, Poland.

25. Confidentiality

Each party keeps secret the information of the other party that is designated as confidential or whose confidentiality follows from the circumstances, uses it only to perform this contract and makes it available only to persons who need it for this purpose and are bound to equivalent confidentiality. Confidential information includes in particular check results for Customer domains, findings on exposed files and security vulnerabilities, login credentials and keys, non-public parts of the Service and individually agreed prices. This does not apply to information that is public without a breach of duty, that was already lawfully known, that was obtained independently or whose disclosure is required by law, a court or an authority; in the last case, the disclosing party informs the other party in advance, where permitted.

A report whose address the Customer passes on is visible from then on to anyone with this address; this is not a breach of this clause by us. Reports from the account do not expire as long as the check result exists; the Customer should therefore pass on their addresses with care.

The obligations under this clause continue for three years after the end of the contract, and for trade secrets and personal data for as long as they are protected.

26. Intellectual property and rights of use

26.1 Our rights

The Service with its software, its detection rules, texts, instructions and graphics, the name formexposed, the logos and the badge belong to us or our licensors. No rights are granted beyond those expressly granted here. Third-party components are subject to their own licences.

26.2 The Customer’s rights to the Service

For the term of the contract, the Customer receives the non-exclusive, non-transferable right to use the Service within their plan for their own business purposes and, as an agency, for their clients’ websites. The Customer may store and print reports, evidence logs, instructions and protection components for these purposes and pass them on to the operators of the checked websites. The Customer may build protection components and code modified by “Fix it for me” into their websites and use them there without time limit, including after the end of the contract.

26.3 The extensions

The WordPress plugin, the MainWP extension and the TYPO3 extension are licensed under the GNU General Public License, version 2 or later (clause 13.1). This licence permits use, modification and distribution of the code; these Terms do not restrict this. Anyone who connects a modified version to the Service is responsible for the consequences of their modification. The name formexposed and our logos are not covered by the licence of the code.

26.4 The Customer’s content

Logos, trademarks, company names, notice texts and notes that the Customer stores remain the Customer’s. The Customer grants us the free-of-charge, non-exclusive, territorially unlimited right to store them and display them in the reports, portals and summaries chosen by the Customer, for as long as the Customer uses them there, in the fields of exploitation required for this (pola eksploatacji, Art. 50 of the Polish Copyright Act, ustawa o prawie autorskim i prawach pokrewnych): storage and reproduction in our systems and backups, and making available to the public in these reports, portals and summaries. The Customer warrants that they are entitled to do so.

26.5 Aggregated information

We may use check results in aggregated form that can no longer be attributed to any domain, Customer or natural person, for example for comparison figures (“better protected than a share of the sites checked”, only from totals of at least 20 websites), for improving the detection rules and for published analyses that state only totals. We never name Customer domains in such analyses. If this clause and the DPA differ, the DPA prevails.

26.6 Feedback and references

We may use the Customer’s suggestions and requests for improvement without restriction and without remuneration. To the extent that a suggestion is protected by copyright, the Customer grants us a free-of-charge, non-exclusive, transferable and sublicensable licence, unlimited in time and territory, in the fields of exploitation of reproduction, adaptation, incorporation into the Service, distribution and making available to the public, and permits the use of adaptations. We name the Customer as a reference only with their prior consent in text form, which they may withdraw at any time.

27. Availability, maintenance, support and technical requirements

27.1 No availability commitment

We operate the Service with the care of a prudent provider and aim for high availability. We do not commit to any particular availability in any plan. A service level agreement, an availability figure, a recovery time or service credits are not part of the contract unless agreed individually in text form. An availability figure shown on our status page reflects our own measurement; it is neither a warranty nor an acknowledgement.

27.2 Maintenance

We may interrupt the Service for maintenance, updates and security measures. We schedule planned interruptions in low-traffic periods where possible and announce longer ones in advance. Urgent measures to avert a security risk or a serious disruption may be taken without notice. During maintenance, checks and alerts may run late; they are caught up with the next run.

27.3 Disruptions outside our sphere

The Service depends on the public internet, on the reachability of the checked websites, on their firewalls and bot protection, on DNS and registries, on payment, mail, chat and CAPTCHA services and on public databases of security vulnerabilities and blocklists. Disruptions in these areas are beyond our control and are not a defect of the Service.

27.4 Our own monitoring

We monitor the Service ourselves, including the scan server and the queue, and are notified of outages. This shortens disruptions but does not prevent them.

27.5 Support

We provide support in German, English and Polish via the support window, the contact page and by e-mail, on working days in Poland (Monday to Friday, except public holidays). We endeavour to reply promptly; statements in the interface on the usual response time are based on experience and are not a commitment. Where the pricing page states “priority support” for a plan, we handle its requests with priority, without committing to a particular time frame. Support concerns the Service; it does not include work on the Customer’s website, forms, hosting or mail settings and is not legal or security advice.

27.6 Technical requirements

To use the Service, the Customer needs:

• internet access, an up-to-date browser with JavaScript enabled and cookies allowed for formexposed.com, and an e-mail address that they check;
• for the WordPress plugin, WordPress version 6.2 or later and PHP version 7.4 or later;
• for the MainWP extension, WordPress version 6.0 or later, PHP version 7.4 or later and an API key; a MainWP dashboard is required to assign the websites;
• for the TYPO3 extension, TYPO3 12.4, 13.4 or 14.3 and PHP version 8.2 or later; for counting submissions, Powermail;
• for the interfaces, an HTTPS-capable client and an API key;
• for proof of control, checks and monitoring, a publicly reachable website that allows the crawler.

For features such as the delivery check, webhooks or chat alerts, the Customer additionally needs access to the relevant settings of their form or service.

27.7 Software and data we place

Our website sets technically necessary cookies: a session cookie (for sign-in, protection against form abuse and limits) and, only on request at sign-in, a cookie that keeps the user signed in for 30 days; the choice between light and dark appearance is stored locally by the browser. Google reCAPTCHA is loaded only when certain forms are submitted. The extensions output a meta tag for proof of control on the Customer’s website and store their settings in the website’s database. Details are given in the Privacy Policy. We do not set any advertising or analytics cookies.

27.8 Risks of using the internet

Like any use of the internet, use of the Service involves risks, for example from malware, fake messages pretending to come from us (phishing), interception of data or unauthorised access to an account. We encrypt all connections to our servers. The Customer protects their devices and login credentials, uses two-factor sign-in and checks whether a message that purportedly comes from us refers to formexposed.com.

28. Defects and warranty

28.1 What we do

If the Customer reports a fault in the Service, we remedy it within a reasonable period, depending on its severity, by a correction, a workaround or a new version. A fault exists if the Service deviates from the description in these Terms and on the pricing page in a way that significantly impairs its use; whether this is the case is determined by this standard, not by our assessment. The Customer describes the fault as precisely as they can so that we can reproduce it.

28.2 What is not a defect

What these Terms describe as a property of the Service is not a defect: that a result is a snapshot and detection rules can be wrong (clause 5.3), that checks remain incomplete if the crawler is blocked, that forms with CAPTCHA can only be actively checked to a limited extent (clause 8.5), that alerts may fail to arrive (clause 9.5), that output from a language model may be wrong (clause 12.2) and that third-party services fail (clause 27.3).

28.3 Statutory warranty

To the extent that the provisions of the Polish Civil Code on warranty for defects (rękojmia) apply to this contract, this warranty is excluded, as permitted between businesses by Art. 558 § 1 KC. It is replaced by our obligation under clause 28.1. The exclusion does not apply if we have fraudulently concealed a defect (Art. 558 § 2 KC). We do not give a quality guarantee (gwarancja). The exclusion does not apply to sole traders within the meaning of clause 1.3; the statutory provisions apply to them, including the provisions of the Consumer Rights Act on the conformity of digital services with the contract, to the extent that they are applicable to them.

28.4 No promise of success

We do not promise that use of the Service will prevent spam, increase the number of enquiries, uncover a particular problem or ensure that an audit by third parties (such as a supervisory authority, an insurer or a client) is passed, or that a recommendation derived from it is correct.

29. Liability

How this clause is structured. It first states what is not limited, because that part cannot validly be limited and a clause that pretended otherwise would be worthless. It then sets out how far we are liable for slight negligence and, finally, deals with free services.

29.1 What is not limited

We are liable without limitation

• for damage caused intentionally; an advance exclusion of this liability is invalid under Art. 473 § 2 KC;
• for damage caused by gross negligence;
• for damage resulting from injury to life, body or health;
• under mandatory product liability provisions and under a guarantee expressly given in text form;
• in any other case in which liability cannot validly be excluded or limited.

Claims under Art. 82 GDPR are outside every limit in this clause. A data subject is not a party to this contract; their claim against us is governed solely by Art. 82 GDPR, and nothing that the Customer and we agree can cap or remove it. What we can and do settle between ourselves is the recourse after such a claim has been satisfied; it follows Art. 82(4) and (5) GDPR, the DPA and clause 30. This recourse between the Customer and us is not restricted by the limits in this clause either. For all other claims between the Customer and us, including under the DPA, clauses 29.2 to 29.6 apply.

29.2 Slight negligence

Otherwise, we are liable for damage caused by slight negligence only if we breach an essential contractual obligation, that is, an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the Customer may regularly rely. Essential obligations include in particular the obligations to provide the Service essentially as described, to check only to the extent instructed, to send test submissions only in accordance with clause 8.2 and to protect customer data in accordance with the DPA. In this case, our liability is limited to the damage typical for the contract and foreseeable at the time the contract was concluded, and in total to the fees the Customer paid us in the twelve months before the event causing the damage. This limit applies jointly to all damaging events occurring within twelve months; the relevant fees are then those of the twelve months before the first of these events.

In the case of slight negligence, we are not liable for loss of profit (utracone korzyści), lost enquiries, orders or revenue, costs of business interruption or loss of reputation; to that extent, the scope of compensation is agreed in derogation from Art. 361 § 2 KC, as that provision permits.

29.3 Free services

To the extent that we provide a service free of charge, that is, for the free check, free tools, the Free plan, during a trial period, for an activation without payment and for the use of the extensions without a paid plan, we are liable only under clause 29.1, that is, for intent, gross negligence and the cases listed there. This limitation applies only in the relationship between the Customer and us; it does not affect claims under Art. 82 GDPR.

29.4 Special cases

Subject to clause 29.1, we are not liable

• for the consequences of properly labelled test submissions within the scope instructed (clause 8.4);
• for decisions made by the Customer or by an assistant or automation service used by the Customer on the basis of the results;
• for code that the Customer builds in under clause 12 and for settings the Customer chooses in the extensions, including the deletion of enquiries by retention periods and the stopping of real enquiries by filters;
• for acts, outages and terms of third-party services that the Customer engages (clauses 9.3 and 16);
• for the loss of data, to the extent that it could have been avoided by a customary backup on the Customer’s side.

29.5 Notice of damage

The Customer should notify us in text form of any damage for which they hold us responsible within 30 days of becoming aware of it, stating what happened and when. We delete logs from which an event can be clarified after set periods (60 days for the page request log, 90 days for the alert log); an event notified later can often no longer be clarified. Statutory limitation periods are not shortened by this.

29.6 Who benefits from these rules

The limitations in this clause also apply for the benefit of our employees, representatives, vicarious agents and subcontractors and to claims on any legal basis. The parties consider this allocation of risk between businesses to be appropriate; the fees are calculated on its basis. Clauses 29.2 to 29.4 do not apply in relation to sole traders within the meaning of clause 1.3 or in relation to consumers using the free check or a free tool; in relation to them, we are liable in accordance with the statutory provisions (cf. Art. 385³ no. 2 and Art. 385⁵ KC).

30. Indemnification

The Customer indemnifies us against claims, proceedings and costs of third parties, including the necessary costs of legal defence in the amount of the statutory fees or, where there are none, the customary market fees, arising from the Customer

• adding domains or having them checked without authorisation, or obtaining proof of control for a third-party domain by deception;
• not informing recipients of form e-mails, visitors to their websites or the subscribers of their client portals as required by these Terms and the law;
• storing login credentials that they were not permitted to store (clause 10.4);
• using the prospect check contrary to clause 15.5, or making impermissible statements or infringing third-party rights in white-label reports and portals;
• otherwise using the Service contrary to clause 23.

This does not apply to the extent that the Customer is not responsible for the breach of duty. We inform the Customer without undue delay, at the latest within 14 days of becoming aware of it, of any such claim, do not acknowledge it without the Customer’s consent and give the Customer the opportunity to defend against it. Fines are covered only to the extent that recourse for them is legally permissible. This clause does not change the allocation of responsibility under Art. 82 GDPR.

31. Blocking

We may block access to the Service, to a workspace, to a domain, to a feature or to an interface in whole or in part if

• there is a well-founded suspicion that a domain is being checked without authorisation or that the Service is being used contrary to clause 23;
• the use endangers the security or availability of the Service, of other Customers or of third parties;
• a payment due is still not made 14 days after a reminder in text form;
• an authority, a court or the law requires it;
• a credible report under clause 33 indicates a serious infringement and immediate action is required.

We limit the block to what is necessary and state what will remedy the situation. Except in the case of a block because of a missing payment, which is preceded by the reminder, we hear the Customer beforehand: we inform them in text form which conduct we object to, what we base this on and which measure we are considering, and they may comment or remove the reason within seven days. We block without a prior hearing only if waiting would seriously endanger third parties or the Service or if an authority, a court or the law requires it; in that case, we initially limit the block to the domain or feature concerned, inform the Customer of it without undue delay, at the latest on the following working day, with reasons in text form, to the extent that this does not defeat the purpose and is not prohibited by law, and hold the hearing afterwards. The Customer may object to a block in text form; we reply within 14 days with reasons. The details and examples of urgent cases are described on the Acceptable Use and Abuse page. If the reason ceases to exist, we lift the block. Checks that did not take place during a block cannot be made up. The block does not affect the obligation to pay, unless the Customer was not responsible for it.

32. Force majeure

Neither party is liable for non-performance caused by an event beyond its reasonable control, such as natural disasters, war, terrorism, epidemics, strikes, a prolonged failure of the power supply or of the public internet, attacks on infrastructure it does not control, or acts of public authorities. The affected party informs the other party without undue delay and resumes performance as soon as it can. If the event lasts longer than 60 days, either party may terminate the affected contract without notice; we refund fees paid in advance for the period thereafter on a pro rata basis. Lack of funds is never force majeure. The obligation to pay for services already provided remains unaffected.

33. Reports of abuse, unlawful content and security vulnerabilities

Anyone can report to us that the Service is being abused, for example that a domain is being actively checked without authorisation, that test submissions are causing disruption, that a client portal or white-label report contains unlawful content or that someone is sending summaries of findings without consent. Reports go to contact@lukaswojcik.com or via the contact page and should identify the domain or the link, describe the allegation and state a way to reply. Anyone who wants to exclude their domain from all checks uses /opt-out; the exclusion applies to the domain and its www variant and takes effect from the next check.

We examine sufficiently precise reports. If a report is justified, we act under clauses 31 and 20.5, inform the Customer concerned with reasons, unless prevented by law or an authority, and inform the reporting person of the outcome, where permissible. Security vulnerabilities in formexposed are reported via our vulnerability reporting point; the rules under which we accept reports are set out there. A report is not a complaint; complaints are dealt with in clause 35.

To the extent that we store content provided by the Customer and made accessible to third parties, in particular in client portals, white-label reports, logos and notice texts, we provide a hosting service within the meaning of Regulation (EU) 2022/2065 (Digital Services Act) in that respect. We accept notices of illegal content under Art. 16 of that Regulation electronically via the channels mentioned; they should contain the exact location, an explanation of why the content is illegal, the name and e-mail address of the person submitting the notice and their statement that the information is accurate and complete to the best of their knowledge (Art. 16(2)). We confirm receipt and inform the person submitting the notice of our decision. If we restrict content or an account as a result, we provide the Customer with a statement of reasons under Art. 17 of that Regulation and inform them of the means of redress: the objection under clause 31, the complaint under clause 35 and recourse to the courts. Decisions on notices and on the restriction of content are taken by a human; the automated abuse prevention in clause 18.5 assesses requests to the Service, not Customer content. The point of contact for authorities of the Member States, the European Commission and the European Board for Digital Services (Art. 11 of that Regulation) and for users (Art. 12 of that Regulation) is contact@lukaswojcik.com, in German, English and Polish.

34. Changes to these Terms

34.1 Only for an objective reason

We change these Terms only for one of the following objective reasons: because of a change in the law or its interpretation by courts and authorities, because of a change to the Service, its features or its technical basis, because of a change of a third party necessary for its provision, to prevent abuse or security risks, or to correct errors and ambiguities. Prices are governed separately by clause 19.8.

34.2 Notice

We announce every change at least 30 days before it takes effect by e-mail to the account holder’s address stored in the account and on the Changes to the Contract Documents page, with the amended wording, the reason and the planned date, and explain what the change means for the Customer and what options the Customer has. Each version bears a number and a date; the Changes to the Contract Documents page lists them.

34.3 Silence is not consent

Silence and mere continued use do not count as consent. Where a change affects the Customer’s rights or obligations, we obtain the Customer’s consent separately and expressly and record it in a verifiable manner. If the Customer does not consent and does not object either (clause 34.4), the previous Terms continue to apply to them; they do not have to do anything for this. Our right to ordinary termination under clause 20 remains unaffected.

34.4 Objection

The Customer may object in text form to an announced change until it takes effect. An objection ends the contract for a paid plan at the end of the current billing period and the contract for an account on the Free plan when the change takes effect; until then, the previous Terms apply. We refund fees paid in advance for the period after the end of the contract on a pro rata basis. We point out this right and its consequences in every announcement.

34.5 Changes without notice period

Without the notice period under clause 34.2, we may make changes that are exclusively to the Customer’s advantage, that are purely linguistic or that correct obvious errors, and changes that a law, a court or an authority requires with a shorter period or that are necessary to avert an imminent security risk. We communicate these as soon as possible and state the reason. Clause 34.3 remains unaffected.

35. Complaints

The Customer can submit complaints about the service at any time by e-mail to contact@lukaswojcik.com, via the support window or the contact page, and also by post to the address in clause 1.1. Whether a communication is a complaint depends on its content, not on its heading. A complaint should contain the e-mail address of the account, a description of the problem with date and time, where applicable the domain or the link to the report, and what the Customer is requesting. We confirm receipt, examine the complaint and reply in text form within 14 days of receipt. The reply states whether we accept the complaint or reject it in whole or in part, gives the reasons and, if we provide a remedy, what we will do and by when. If the examination takes longer, we say so within this period, with the reason and the expected date. If information is missing, we ask for it; such a query does not stop the period. If we do not reply in time, the Customer may pursue their claim as if we had rejected it; silence does not count as acceptance, unless mandatory law provides otherwise. For consumers using the free check, under Art. 7a of the Polish Consumer Rights Act a complaint is deemed accepted if we do not reply within 14 days of receipt; in relation to them, notice of a longer examination does not replace the reply.

This clause governs the complaints procedure within the meaning of Art. 8(3)(4) UŚUDE. The Complaints page explains the process and the out-of-court routes; if it promises the Customer more than this clause, that promise also applies. Where mandatory law additionally attaches further periods or consequences to a complaint, for example the rights of sole traders within the meaning of clause 1.3 in the case of a digital service that does not conform with the contract, these remain unaffected. A complaint is not a prerequisite for asserting a claim in court.

36. Right of withdrawal for sole traders

Businesses have no right of withdrawal. Polish law makes an exception for natural persons who conclude a contract directly connected with their business activity but for whom, according to its content, the contract is not of a professional nature (Art. 38a of the Polish Consumer Rights Act, clause 1.3). Whether, how and with what consequences this group has a right of withdrawal is described on the Right of Withdrawal for Sole Traders page. It applies only to this group and, to that extent, takes precedence over these Terms.

Neither registration nor the checkout currently asks for an express request to begin performance before the withdrawal period expires. If an entitled person withdraws in time, we therefore refund all payments under the contract withdrawn from without deduction for the period in which they have already used the plan, without undue delay and at the latest within 14 days of receipt of the withdrawal, using the same means of payment, and the right of withdrawal does not expire early. The account then continues on the Free plan. Clause 19.11 does not preclude this. Before the purchase we refer to the information on withdrawal in the Billing area and on the checkout page; after the purchase we confirm the contract, together with that information, by e-mail.

37. Partner programme

To the extent that we offer a partner programme in which Customers receive a commission for recommending formexposed, the Partner terms apply separately. These Terms apply in addition, unless the Partner terms provide otherwise. There is no entitlement to participation.

38. General provisions

38.1 Assignment

The Customer may assign the contract or rights under it only with our consent in text form, which we will not unreasonably withhold. We may transfer the contract in connection with a conversion, in particular the conversion of the sole proprietorship into a company, or a transfer of the business to a legal successor, and will inform the Customer of this in text form at least 30 days in advance. The Customer may then terminate the contract with immediate effect until 30 days after receipt of the notice; we refund fees paid in advance for the period thereafter on a pro rata basis. If the acquirer is established outside the European Economic Area, the Customer may also terminate as of the date of the transfer.

38.2 Subcontractors

We may use subcontractors to fulfil our obligations and are responsible for their performance as for our own. Sub-processors are governed by the DPA.

38.3 Entire agreement

The documents in clause 3.1 contain the entire agreement on their subject matter. Liability for fraudulent misrepresentation remains unaffected.

38.4 Severability

If a provision is invalid or unenforceable, the remainder of the contract remains valid. The statutory rule takes its place. If a provision is invalid only in relation to a particular Customer or only in part, it remains valid otherwise and in relation to all other Customers. In relation to consumers and sole traders within the meaning of clause 1.3, this does not apply to a provision that is not binding on them under Art. 385¹ KC: it lapses in its entirety in relation to them, without being reduced to what is just still permissible, and the contract otherwise remains binding (Art. 385¹ § 2 KC).

38.5 Notices

Notices under these Terms are given in text form: to the Customer, to the e-mail address stored in the account or as a message in the account; to us, to contact@lukaswojcik.com or to the address in clause 1.1. Keeping the e-mail address up to date is the Customer’s responsibility. An e-mail is received as soon as it has arrived in the recipient’s mailbox in such a way that, under normal circumstances, they can take note of it (Art. 61 § 2 KC). Terminations and objections require text form; a message in a chat window is not sufficient, except for the switching declaration under clause 20.3. Transactional e-mails of the Service (such as alerts, invoices, notices of the end of a trial period) are part of the service; we send advertising only with consent.

38.6 No waiver

Failure to exercise a right, or late exercise of it, does not constitute a waiver. A waiver is effective only if declared in text form, and only for the case stated.

38.7 No partnership

The parties are independent businesses. This contract does not create a partnership, agency, employment relationship or joint controllership within the meaning of Art. 26 GDPR.

38.8 Headings and examples

Headings are for ease of reference and do not affect interpretation. A list introduced by “in particular”, “such as” or “for example” is illustrative, not exhaustive.

38.9 Third parties

The contract creates rights only for the parties. Operators of checked websites, visitors to the Customer’s websites, members and subscribers acquire no rights of their own under it; their statutory rights, in particular under the GDPR, remain unaffected.

38.10 Electronic records

The parties recognise the electronic records of the Service, in particular the record of consent (clause 4.4), the activity log, check and alert logs and evidence logs, as evidence; they are documents within the meaning of Art. 77³ KC. The court’s free assessment of them and proof to the contrary remain unaffected.

39. Governing law, jurisdiction and language

39.1 Governing law

The contract is governed by the law of the Republic of Poland, excluding the UN Convention on Contracts for the International Sale of Goods; the same applies to non-contractual obligations arising from or in connection with it, to the extent that a choice of law is permissible under Art. 14 of Regulation (EC) No 864/2007 (Rome II). Mandatory provisions that cannot be derogated from by agreement remain unaffected. For consumers using the free check or a free tool, this applies in particular to the protection afforded by the mandatory provisions of the State of their habitual residence under Art. 6(2) of Regulation (EC) No 593/2008 (Rome I).

39.2 Jurisdiction

The courts in Łódź, Poland, competent for our registered place of business have exclusive jurisdiction over all disputes arising from or in connection with the contract. This agreement is made under Art. 25 of Regulation (EU) No 1215/2012 and Art. 46 of the Polish Code of Civil Procedure (Kodeks postępowania cywilnego); the electronic consent recorded under clause 4.4 is its durable record. We may also sue the Customer at their general place of jurisdiction, provided that it is in a Member State of the European Union or a State party to the Lugano Convention. Jurisdiction for interim relief and the powers of the supervisory authorities remain unaffected. This clause does not apply in relation to consumers, for example in the case of the free check, or in relation to sole traders within the meaning of clause 1.3; for them, the statutory places of jurisdiction remain applicable, for consumers in particular Art. 18 and 19 of Regulation (EU) No 1215/2012 (cf. Art. 385³ no. 23 KC).

39.3 Language

These Terms are available in all official languages of the European Union. In the event of discrepancies or questions of interpretation, the Polish version prevails. The same applies to the other contract documents in clause 3.1. The interface of the Service is available in all official languages of the European Union; support is provided in German, English and Polish, and notices may be given in any of these three languages. The record of consent records which language version the Customer saw at registration (clause 4.4).

40. Contact and version

LW IT Solutions Company Lukas Wójcik · al. Tadeusza Kościuszki 80/82, lok. 301 · 90-437 Łódź · Poland · NIP 7252266190 · VAT ID PL7252266190 · contact@lukaswojcik.com · Contact page

Related documents: Data Processing Agreement · Technical and Organisational Measures · Sub-processors · Acceptable Use and Abuse · Privacy Policy · EU Data Act · EU AI Act · Complaints · Right of Withdrawal for Sole Traders · Imprint · Legal Documents at a Glance

Version 2.2 · Last updated: 29 October 2026. New clause 5.7 on the formconfirmed form protection; it applies only to Customers who switch it on. No other provision changes.

Version 2.1 · Last updated: 22 October 2026. In the event of discrepancies, the Polish version now prevails instead of the German one; these Terms and the contract are available in all official languages of the European Union (summary, clauses 4 and 39.3). No other provision changes.

Version 2.0 · Last updated: 11 October 2026. This version completely replaces the Terms dated 9 October 2026. It has been restructured and describes the Service as it is built: new are in particular the definitions and the order of precedence of the contract documents, the record of consent, an express list of what the Service is not, the description of browser journeys, the scan behind the login, the delivery check, the badge, the evidence log, agency features, the API and the MCP server, the rules on the prospect check, account deletion, the trial period and payment on invoice, the maximum notice period when switching provider under the Data Act, the mechanism for changes without consent by silence, and the references to the complaints, withdrawal and partner pages.