Terms of Service

Effective 26 October 2026

Particle Signals · Mindprint FZ-LLC · Includes the Data Processing Addendum (Schedule 1) and Security Measures (Schedule 2)

These Terms of Service ("Terms") are an agreement between Mindprint FZ-LLC, trading as Particle Signals ("Particle", "we", "us"), a Free Zone company licensed by the Dubai Development Authority (licence number 107366), whose registered office is HD65A, First Floor, In5 Tech, Dubai Internet City, Dubai, United Arab Emirates, and the business that subscribes to the Service ("Customer", "you").

By ticking the box to accept these Terms at checkout, or by using the Service, you accept these Terms on behalf of your business and confirm that you have authority to do so. The Service is for business use only. These Terms include Schedule 1 (Data Processing Addendum) and Schedule 2 (Security Measures).

1.The Service

1.1 Particle Signals, including the AI assistant "Ernest" (the "Service"), helps recruitment agencies find business development opportunities. It watches the companies you choose for signals such as new roles, leadership changes and company news, suggests people to contact, estimates the value of each opportunity and helps you prepare outreach.

1.2 The Service is in active development. We may add, change or remove features at any time. If we remove a core feature you rely on, we will tell you, and you may cancel under section 4.

1.3 Signals, contact details, value estimates and AI-generated text are suggestions. You decide what to do with them. You should review any draft before using it.

2.Accounts and seats

2.1 Each paid seat is for one named person. Logins must not be shared.

2.2 You are responsible for your users, for keeping login details secure, and for everything done under your account. Tell us promptly at privacy@particleex.com if you suspect unauthorised access.

2.3 Usage limits apply as shown in the Service (for example, the number of opportunities per consultant per day and contact searches per signal). We may change these limits on reasonable notice.

3.Fees and payment

3.1 The fee is US$199 per seat per month, unless we agree a different price with you in writing.

3.2 Fees are paid monthly in advance by card through our payment provider, Stripe, and renew automatically each month until you cancel.

3.3 Fees exclude any applicable taxes, which you are responsible for.

3.4 We may change our prices by giving you at least 30 days' notice by email. The new price applies from your next billing date after the notice period.

3.5 If a payment fails, we may suspend access until it is paid.

4.Cancellation and termination

4.1 You can cancel at any time. Your access continues until the end of the month you have already paid for, and then stops. We do not refund part-months.

4.2 We may end your subscription by giving you 30 days' notice. If we do this for a reason other than your breach, we will refund any fees paid for the period after your access ends.

4.3 Either party may end these Terms immediately by written notice if the other materially breaches them and, where the breach can be fixed, does not fix it within 14 days of being asked to.

4.4 When your subscription ends, we will delete your Customer Data as set out in Schedule 1.

5.Your data

5.1 "Customer Data" means the information you or your users put into the Service, including your client and target lists, CRM data you connect, files, writing samples, settings and drafts. You own your Customer Data.

5.2 You give us permission to use Customer Data only to provide, support and secure the Service for you, as described in Schedule 1. We do not sell Customer Data and we do not share it with other customers.

5.3 We do not use Customer Data to train AI models. Our AI provider, OpenAI, does not use data sent through its API to train its models; as standard, it may keep that data for up to 30 days to monitor for abuse, then deletes it. We may use anonymised, aggregated information about how the Service is used (which does not identify you, your users or any individual) to operate and improve the Service.

5.4 You must have the right to give us your Customer Data. Do not upload special categories of personal data (such as health information) unless the Service is specifically designed for it.

6.Business contact data and signals

6.1 The Service gives you company signals and business contact details (such as name, job title, work email and work phone) obtained from public sources and third-party data providers ("Business Contact Data").

6.2 Business Contact Data obtained for your account is made available only to your account. It is not shared with other customers.

6.3 You may use Business Contact Data only for your own internal business development. You must not resell it, publish it or give it to anyone else.

6.4 Business Contact Data is provided "as is". We do not guarantee that it is accurate, complete or up to date.

7.Your responsibility for outreach

7.1 You decide whether and how to contact anyone. Any email, call or message you send is sent by you, and you are responsible for it.

7.2 You must comply with all laws that apply to your outreach, including the UK GDPR, the Privacy and Electronic Communications Regulations (PECR), and any equivalent laws in the countries where the people you contact are based. This includes screening phone numbers against the Telephone Preference Service and Corporate TPS before calling, honouring opt-outs promptly, and identifying yourself clearly.

7.3 For outreach to people whose details you obtained through the Service, you act as an independent controller of that personal data.

7.4 The Service does not send outreach automatically. Where sending from your own mailbox is available, nothing is sent without your user's approval.

8.Acceptable use

You must not, and must not let anyone else:

use the Service to send spam or for any unlawful, harassing or misleading purpose;
copy, scrape, resell or sublicense the Service or its data;
reverse engineer the Service, or use it to build a competing product;
try to access other customers' data or interfere with the security or operation of the Service;
upload malicious code or content you do not have the right to use.

We may suspend access if we reasonably believe these rules are being broken, and will tell you why.

9.Data protection

9.1 Where we process personal data on your behalf, we act as your processor and Schedule 1 (Data Processing Addendum) applies. It forms part of these Terms.

9.2 Our Privacy Policy at particleex.com/privacy explains how we handle personal data where we act as controller, including your users' account data and Business Contact Data.

9.3 Our current sub-processors are listed at particleex.com/subprocessors.

10.Confidentiality

Each party will keep the other's confidential information confidential and use it only for the purposes of these Terms. This does not apply to information that is public, already known to the recipient, independently developed, or that must be disclosed by law.

11.Intellectual property

11.1 We own the Service, including its software, models, prompts, designs and improvements, and any know-how we develop in providing it. Nothing in these Terms transfers ownership of them to you.

11.2 We give you a non-exclusive, non-transferable right for your users to use the Service during your subscription, for your internal business purposes.

11.3 If you give us feedback or suggestions, we may use them freely without any obligation to you.

12.Disclaimers

12.1 We will provide the Service with reasonable skill and care. Apart from that, the Service is provided "as is" and "as available".

12.2 We do not promise any particular result, such as a number of meetings, placements or fees, or that the Service will be uninterrupted or error-free. AI-generated content can be inaccurate and must be reviewed before use.

13.Liability

13.1 Nothing in these Terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited by law.

13.2 Neither party is liable for any loss of profit, revenue, business, goodwill or anticipated savings, or for any indirect or consequential loss.

13.3 Each party's total liability under or in connection with these Terms (including Schedule 1) is limited to the fees paid and payable by you in the 12 months before the event giving rise to the claim.

14.Changes to these Terms

We may update these Terms. We will give you at least 30 days' notice by email of any material change. If you continue to use the Service after the change takes effect, the new Terms apply. If you do not agree, you may cancel before then.

15.General

15.1 Notices: we will send notices to the email address on your account. You can send notices to privacy@particleex.com.

15.2 Assignment: you may not transfer these Terms without our consent. We may transfer them to a group company or to a buyer of our business, and will tell you if we do.

15.3 Events beyond control: neither party is liable for delay or failure caused by events outside its reasonable control.

15.4 Entire agreement: these Terms (with the Schedules and any written order we agree) are the whole agreement between us about the Service. If they conflict, Schedule 1 prevails on data protection matters.

15.5 Third parties: no one other than you and us has any right to enforce these Terms.

15.6 Law and courts: these Terms and any dispute arising from them are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule 1: Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms between the Customer and Mindprint FZ-LLC trading as Particle Signals ("Processor"). It is accepted when the Customer accepts the Terms. It applies where the Processor processes personal data on the Customer's behalf in providing the Service.

1. Definitions

"Data Protection Law" means the UK GDPR, the UK Data Protection Act 2018, the EU GDPR (where applicable), the UAE Federal Decree-Law No. 45 of 2021 and any other data protection law that applies to the processing. "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach" and "Processing" have the meanings given in the UK GDPR. "Customer Personal Data" means Personal Data in the Customer Data that the Processor processes on the Customer's behalf. "Sub-processor" means a third party engaged by the Processor to process Customer Personal Data.

2. Roles

2.1 For Customer Personal Data, the Customer is the Controller and the Processor is its Processor.

2.2 For Business Contact Data that the Processor obtains from public sources and third-party providers, and for users' account data, the Processor acts as an independent Controller, as described in its Privacy Policy. When the Customer uses Business Contact Data for its own outreach, the Customer acts as an independent Controller of that use.

3. Processor obligations

The Processor will:

process Customer Personal Data only on the Customer's documented instructions (which are the Terms, this DPA and the Customer's use of the Service), unless the law requires otherwise, in which case it will tell the Customer first unless the law prohibits this;
ensure that anyone authorised to process Customer Personal Data is bound by confidentiality;
implement the security measures in Schedule 2;
assist the Customer, taking into account the nature of the processing, to respond to Data Subject requests and to meet its obligations on security, breach notification, data protection impact assessments and consultation with regulators;
make available the information reasonably needed to show compliance with this DPA, and allow audits as set out in section 8;
tell the Customer promptly if it believes an instruction breaks Data Protection Law.

4. Support access

Authorised Particle staff may sign in to the Customer's account as a user only to provide support or investigate a problem. This access is restricted to named staff and every use is logged.

5. Sub-processors

5.1 The Customer gives general authorisation for the Processor to use the Sub-processors listed at particleex.com/subprocessors.

5.2 The Processor will give at least 14 days' notice of any new Sub-processor by updating that page and emailing the Customer's account owner. If the Customer reasonably objects on data protection grounds and the parties cannot resolve it, the Customer may cancel and receive a refund of any fees paid for the period after cancellation.

5.3 The Processor will put in place a written contract with each Sub-processor with data protection obligations no less protective than this DPA, and remains responsible to the Customer for its Sub-processors.

6. International transfers

6.1 Customer Data is hosted in the United Kingdom (Amazon Web Services, London region). The Processor is established in the United Arab Emirates and some personnel and Sub-processors operate outside the UK.

6.2 To the extent the Customer's transfer of Customer Personal Data to the Processor is a restricted transfer, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two: controller to processor) and the UK International Data Transfer Addendum to them (issued by the Information Commissioner, version B1.0) are incorporated into this DPA by reference, completed as follows: the Customer is the data exporter and the Processor is the data importer; the details of processing are in Annex A; the security measures are in Schedule 2; Clause 7 (docking clause) applies; Clause 9 option 2 (general authorisation) applies with 14 days' notice; Clause 11 optional wording does not apply; the governing law and courts are those of Ireland for the EU clauses, and the UK Addendum is governed by the laws of England and Wales; and either party may end the UK Addendum as permitted by its Section 19.

6.3 The Processor will ensure that onward transfers to Sub-processors outside the UK are covered by appropriate safeguards, such as the Standard Contractual Clauses with the UK Addendum, or an adequacy decision.

7. Personal Data Breach

The Processor will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. It will provide the information reasonably available about the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed, and will update the Customer as more information becomes available.

8. Audits

On reasonable written request, no more than once in any 12 months (unless required by a regulator or following a Personal Data Breach), the Processor will provide information and answer written questions reasonably needed to demonstrate compliance with this DPA. Any further audit will be at the Customer's cost, on at least 30 days' notice, during business hours, subject to confidentiality, and without access to other customers' data.

9. Return and deletion

When the Customer's subscription ends, the Processor will delete Customer Personal Data from its live systems within 30 days, unless the law requires it to be kept. Before then the Customer may ask for an export of its data. Encrypted backups are deleted automatically after 7 days. The Processor may keep its security audit log with the link to the Customer removed. The Processor will confirm deletion in writing on request.

10. Liability and precedence

Liability under this DPA is subject to section 13 of the Terms. If this DPA conflicts with the Terms on data protection matters, this DPA prevails. If the Standard Contractual Clauses or the UK Addendum conflict with this DPA, they prevail.

Annex A: Details of processing

Item	Details
Parties	Exporter: the Customer (Controller). Importer: Mindprint FZ-LLC trading as Particle Signals (Processor), contact privacy@particleex.com.
Subject matter and duration	Provision of the Service, for the term of the subscription plus up to 30 days for deletion.
Nature and purpose	Hosting and processing the Customer's lists, CRM data, files and settings to identify business development opportunities, match them to the Customer's clients, prioritise them, suggest contacts, estimate value, prepare draft outreach, track replies where a mailbox is connected, and send system notifications.
Categories of Data Subjects	The Customer's users (consultants and administrators); contacts at the Customer's clients and prospects held in its lists and connected CRM; candidates whose CVs or profiles the Customer uploads; people who reply to outreach where a mailbox is connected; members of connected Slack or Teams channels where enabled.
Categories of Personal Data	Users: name, work email, sign-in identifier, time zone, email signature, writing samples and style notes, and phone number if WhatsApp is enabled. CRM and lists: names, job titles, work email and phone numbers, account owner, placement and activity records (including fees), and short AI summaries of activity notes (raw note text is not stored). Files: CVs and case studies. Mailbox: sent emails and matched replies. Drafts and the history of edits. Messages sent to the Service through Slack or Teams where enabled. Security and audit logs.
Special categories	None intended. The Customer should not upload special category data. CV files may incidentally contain it and are deleted 90 days after upload; an anonymised candidate profile is kept.
Frequency	Continuous, for the duration of the subscription.
Retention	For the subscription term, then deleted within 30 days (see section 9).
Sub-processors	As listed at particleex.com/subprocessors.
Competent supervisory authority	The UK Information Commissioner's Office for UK Customers; for EU Customers, the authority of the Customer's EU establishment.

Schedule 2: Security measures

Hosting: Amazon Web Services, London region (eu-west-2), United Kingdom.
Encryption in transit: TLS 1.2 or higher for all connections to the Service.
Encryption at rest: the database and uploaded files are encrypted at rest using AWS-managed AES-256 encryption.
Secrets: API keys and mailbox connection tokens are stored in AWS Secrets Manager, not in the application database.
Separation between customers: every customer record is tagged to its agency; every query is restricted to the requesting agency; automated tests check this isolation.
Environments: development and production are separate, with separate infrastructure, access roles and secrets.
Deployment: code is deployed through short-lived credentials (no stored cloud access keys). Every change is reviewed before release.
Vulnerability management: every change is checked automatically for known vulnerabilities in software dependencies and the application container.
Access control: role-based access with least privilege. Production access is limited to named engineers, and multi-factor authentication is required. Access is reviewed regularly and removed promptly when no longer needed.
Logging: the application keeps an audit log of security and administrative actions, including every support sign-in to a customer account. Infrastructure logs and access to production systems are recorded centrally in AWS CloudWatch.
Backups: the database is backed up automatically. Backups are encrypted and kept for 7 days, then destroyed.
Data minimisation: only company website domains are sent to company-signal providers; contact searches send company domain, job titles and country only. CV files are deleted after 90 days.
Personnel: everyone with access to Customer Data is bound by written confidentiality obligations.
Incidents: a documented process covers identifying, containing and fixing incidents, and notifying Customers within 48 hours of a Personal Data Breach.