Terms of service.

These Terms govern your use of CSP Logger (the "Service"), operated by Lova Labs ("we", "us"), a sole proprietorship established at Rietoever 60, 2371 JL Roelofarendsveen, the Netherlands (KvK 42103900, VAT NL005496650B29). By creating an account or using the Service, you agree to these Terms. If you use the Service on behalf of an organisation, you confirm you are authorised to bind it.

1. Who may use the Service

You must be at least 18 years old to create an account and enter into these Terms. You are responsible for keeping your credentials confidential and for activity under your account. Notify us at support@csplog.io if you suspect unauthorised access.

2. What the Service does

CSP Logger collects Content Security Policy violation reports from your websites, filters noise, assembles a policy header from the origins you approve, and provides related tools. Current features and tier limits are described on our pricing page.

Site checks: registering a domain or URL with the Service authorises us to fetch it, so we can confirm the policy header we assembled is actually live. Only register domains and URLs you own or control.

3. Trials

A trial lasts 14 days from registration, is bound to a single registrable domain, and is non-transferable. Each domain may trial once.

4. Acceptable use

You agree not to:

• collect violation reports for domains you do not own or control;
• flood or load-test the ingest endpoint outside legitimate CSP traffic;
• circumvent rate limits, or reverse-engineer or scrape the Service;
• use the Service for unlawful surveillance or to violate anyone's rights.

Enforcement is graduated: a first-time, non-malicious breach receives a warning before any suspension. Clear bad-actor breaches, such as collecting reports for domains you do not control or unlawful surveillance, may result in immediate suspension or termination without warning.

5. Subscriptions, billing, and taxes

Paid subscriptions are sold by Paddle as our Merchant of Record. Paddle handles checkout, recurring billing, invoicing, and applicable VAT or sales tax, which is included in the price shown and calculated for your billing location. Subscriptions renew automatically until cancelled. Upgrades take effect immediately (prorated); downgrades take effect at the end of the current billing period.

If we change prices, existing customers keep their current price for at least 12 months, and we give at least 30 days' notice of any change.

6. Cancellation and refunds

You may cancel at any time from the billing area; access continues until the end of the paid period. Because Paddle is the Merchant of Record, refunds are issued by Paddle at its discretion under its buyer terms, and we do not issue direct refunds. See our Refund Policy.

7. Getting your data out

While your account is active, your violation data and generated policies are visible in the dashboard, and any policy can be copied from the project page. On the Professional plan, the MCP interface also exposes your projects, your top violations, per-project statistics, and your current policy programmatically.

We do not offer a bulk, self-service export. Violation data is deleted continuously as it passes your plan's retention window. Deleting your account deletes the rest immediately; cancelling a subscription does not delete anything. If you want a copy, ask before you delete your account and we will manually export your data and provide it to you; email support@csplog.io. We cannot supply data once it has been deleted.

8. Your data and the rights you grant us

Your violation data and generated policies are yours. You grant us a non-exclusive licence to process your data to operate and improve the Service, including anonymous, aggregated use to improve our shared filter rules, as described in our Privacy Policy.

Violation reports describe the browsing of your website's visitors, so for that data you are the controller and we are your processor under the GDPR. Our Data Processing Agreement is the Article 28 contract governing it, and it takes effect with these Terms. You do not need to sign it separately.

9. Our intellectual property

The Service, including its software, design, and brand, belongs to Lova Labs. We claim no ownership over the CSP policies the Service generates for you.

10. Policy suggestions are not guarantees

The CSP policies the Service assembles for you are suggestions, not guarantees. You must test in Report-Only mode before enforcing. CSP Logger is not liable for damage caused by policies you enforce without testing.

"Verified" is a scoped, point-in-time claim. When the dashboard shows a project as Verified, it confirms the header was live, at the moment we checked, on the pages we fetched. It is not a continuous guarantee, and it says nothing about pages we did not check.

11. Beta features

Features marked "beta" or "experimental" are provided with reduced warranty. We may modify, replace, or remove them with reasonable notice.

12. Service availability

We provide the Service on a best-effort basis and do not guarantee uninterrupted availability or any specific uptime. There is no SLA and no status page at this time. We will communicate incidents by email to your account address, where reasonably possible.

13. Disclaimers and limitation of liability

The Service is provided "as is", without warranties of any kind, express or implied, including fitness for a particular purpose. It is security tooling, not a guarantee of security. To the maximum extent permitted by law, we are not liable for indirect, incidental, or consequential damages, and our aggregate liability for any claim is limited to the fees you paid in the 12 months preceding the claim. Nothing in these Terms limits liability that cannot be limited under applicable law.

14. Indemnification

You will indemnify us against claims arising from your misuse of the Service. We will indemnify you against third-party claims that the Service itself infringes their intellectual property.

15. Termination

We may suspend or terminate access for a material breach of these Terms (subject to the graduated enforcement in section 4). You may terminate at any time by cancelling and deleting your account. Provisions that by their nature should survive termination, including sections 8 to 14, will survive.

16. Changes to these Terms

We may update these Terms from time to time. We will give at least 30 days' notice of material changes by email; continued use after they take effect constitutes acceptance.

17. Governing law and jurisdiction

These Terms are governed by the laws of the Netherlands. Disputes will be resolved by the competent court in Amsterdam (Rechtbank Amsterdam), except where mandatory consumer-protection law grants you the right to bring proceedings elsewhere.

18. Miscellaneous

If any provision is found unenforceable, the rest remain in effect. These Terms, together with the Privacy Policy, the Data Processing Agreement, and the pages they reference, are the entire agreement between you and us regarding the Service.

19. Contact

Questions about these Terms? Email support@csplog.io.