Terms of Service

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Customer", "you") and Sentinel Edge Networks LTD, a private limited company registered in England and Wales (company number 17150600, registered address 134a West Hendon Broadway, London, NW9 7AA, United Kingdom) ("Maskbreak", "we", "us"). By accessing or using any Maskbreak service, API, dashboard, or website, you agree to these Terms in full.

If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity. If you do not have such authority, do not use our services.

The Services are offered only to persons aged 18 or over who use them wholly for business or professional purposes, not as consumers. If you are acting mainly outside your trade, business, craft, or profession, you may browse the public Website but must not create an account or use an API key without our written agreement.

September 2026 clarification: this revision describes the existing public-interest programme and sign-in options, and clarifies data-protection wording. It does not change prices, liability limits, notice periods, or the existing backup-retention commitment.

28 September 2026 changes: this revision adds two obligations for customers. Section 3 adds that you must not use the Services as the basis of decisions about an individual’s creditworthiness, employment, financial status, tenancy or insurability, or of other decisions with legal or similarly significant effects, except where that use complies with applicable law. Section 9 adds that you decide whether rules on storing information on your end-users’ devices require their consent before our browser SDK runs on your site, and obtain it where they do. For accounts created before 28 September 2026 these two additions apply only 14 days after we email the account owner about them (Section 14); until then the previous wording applies. The revision also corrects statements of fact (where data is processed, the sign-in options offered). It does not change prices, liability limits, notice periods, or the existing backup-retention commitment.

30 September 2026 changes: this revision introduces paid plans. Section 4 sets out the monthly allowance of each plan, including the Free plan’s 10,000 visitor checks a month, and what happens when an allowance is used up; Section 5 covers subscriptions, billing through our payment provider Stripe, renewal, cancellation, refunds, price changes and VAT; Section 6 now describes the Free plan. For accounts created before 1 October 2026, the previous standard allowance of 1,000 visitor checks an hour with no monthly cap continues until 31 October 2026, and the Free plan’s monthly allowance applies from 1 November 2026. Nobody is charged unless they choose a paid plan. The revision does not change liability limits or the existing backup-retention commitment.

11 October 2026 clarification: this revision corrects statements of fact: the sign-in options offered, that we refuse registrations with temporary inboxes and email aliases, that public-interest access and quotas apply to the account rather than to one key, what happens to an individually agreed quota when the account starts a paid plan, where in the console an account is deleted, and that closing an account cancels a paid subscription at once. It adds no obligation for customers and does not change prices, allowances, liability limits, notice periods, or the backup-retention commitment.

19 October 2026 changes: for accounts created before 1 October 2026, the previous standard allowance of 1,000 visitor checks per hour with no monthly cap now continues until 30 November 2026, one month longer than the 30 September 2026 revision said; the Free plan’s monthly allowance applies to those accounts from 1 December 2026, unless they have chosen a paid plan. This revision only extends an existing allowance: it adds no obligation for customers and does not change prices, the allowance of any plan, liability limits, notice periods, or the backup-retention commitment.

1. Services

Maskbreak provides bot detection, VPN/proxy identification, antidetect browser detection, device intelligence, and fraud prevention services via a REST API and JavaScript SDK ("Services"). Account creation is available with an email address and password, Google Sign-In or GitHub Sign-In. The Services are offered on a Free plan and on paid subscription plans, as described in Sections 4 to 6 and on our pricing page; approved quota overrides and public-interest access are described in Section 4. We reserve the right to modify, suspend, or discontinue any part of the Services with notice as described in Sections 6 and 14.

2. Account Registration

To access the Services you must create an account. You agree to:

• Provide accurate, current, and complete information during registration.
• Maintain the security of your account credentials and API keys.
• Notify us immediately at support@maskbreak.com of any unauthorized access.
• Not share your API key with third parties or use it across multiple unrelated projects without our written consent.

We may refuse a registration, or a change of an account’s email address, that uses a temporary inbox or an email alias (a forwarding address); please use your own email address.

You are solely responsible for all activity that occurs under your account. We are not liable for any loss or damage arising from unauthorized account access where you failed to maintain credential security.

3. Acceptable Use

You agree to use the Services only for lawful purposes and in compliance with all applicable laws. You must NOT:

• Use the Services to engage in any activity that violates applicable local, national, or international law.
• Attempt to reverse-engineer, decompile, or extract the underlying algorithms or models of the Maskbreak API, except to the limited extent the restriction is prohibited by law or activity is expressly authorised by our Responsible Disclosure Policy.
• Use the Services to build a competing product or service.
• Resell or sublicense API access without our prior written approval.
• Conduct automated stress testing or load testing against the API without prior written permission.
• Use the Services to discriminate against individuals based on protected characteristics (race, gender, religion, nationality, disability, etc.).
• Use the Services to determine an individual’s creditworthiness, employment eligibility, financial status, tenancy or insurability, or as the basis of any other decision with legal or similarly significant effects on an individual, except where that use complies with applicable law, including any requirement for human review. (For accounts created before 28 September 2026, this applies only 14 days after we email the account owner about it.)
• Circumvent, disable, or interfere with bot detection, rate limiting, or anti-scraping measures.

We reserve the right to suspend or terminate access immediately and without prior notice for violations of this section.

4. API Usage Limits & Fair Use

Each plan includes a monthly allowance of visitor checks (calls to /v1/evaluate, including the equivalent calls made through our SDKs) and an hourly cap that protects the Services from abuse. Allowances are counted per calendar month in Coordinated Universal Time (UTC) and reset at the start of the 1st day of each month; unused checks do not carry over.

• Free: 10,000 visitor checks a month, up to 1,000 an hour.
• Starter: 50,000 visitor checks a month, up to 5,000 an hour.
• Growth: 250,000 visitor checks a month, up to 20,000 an hour.
• Scale: 1,000,000 visitor checks a month, up to 50,000 an hour.
• Enterprise: the volume, service levels and terms set out in an executed order form or agreement (Section 17).

Bare IP-address lookups (/v1/lookup, and the lookup_ip tool of our MCP server) have a separate monthly allowance of ten times the plan’s visitor checks (100,000 a month on the Free plan). Calls with the fixed test tokens and the public sandbox key are not counted. Calls made with your test key and the checks run from the console use the full detection and count toward the monthly allowance.

When a monthly allowance has been used up, further calls are refused with HTTP 429 (error code monthly_quota_exceeded) until the allowance resets on the 1st, unless you move to a plan with a larger allowance. We do not charge automatically for usage above an allowance. As a courtesy we email the account owner when about 80% and 100% of the monthly allowance have been used; you remain responsible for monitoring your own usage (the /v1/usage endpoint reports it). Requests that exceed the hourly cap or other fair-use thresholds may also be rate-limited (HTTP 429). An explicitly approved higher quota applies to the relevant account as agreed (see “Existing accounts” below for what happens when such an account starts a paid plan).

Existing accounts: for accounts created before 1 October 2026, the previous standard allowance of 1,000 visitor checks per hour with no monthly cap continues until 30 November 2026. From 1 December 2026 the Free plan’s monthly allowance applies to those accounts, unless they have chosen a paid plan. Accounts with an individually agreed quota keep it; if such an account starts a paid plan, that plan’s allowances apply from then on, unless we agree otherwise in writing. A Growth “founding price” announced earlier in 2026 was withdrawn on 16 August 2026 and nobody was charged for it; it is unrelated to the current Growth plan. For enterprise-scale volumes, contact us at support@maskbreak.com or through our contact page.

4.1 Approved public-interest access

Our public-interest programme removes the account’s monthly allowance and hourly cap for approved government bodies, hospitals, public-health and medical-research organisations, education providers, emergency services, and other eligible public-interest organisations. Approval applies to the organisation and systems we confirm; it does not authorise resale or use for unrelated clients. Programme access is free, has no scheduled expiry, and uses the same API and existing key. Approval does not confer a certification or a contractual service-level guarantee.

“Uncapped” and “no hourly cap” describe the approved account’s usage quota, not unlimited infrastructure capacity or permission to bypass authentication, abuse prevention, or security controls. Authentication and other endpoint-specific limits can still apply. Contact support if a legitimate approved integration is throttled.

5. Pricing, Payment & Billing

The Free plan costs nothing. Paid plans (Starter, Growth and Scale) are subscriptions at the prices shown on our pricing page when you subscribe. Like the Services generally, paid plans are available only to business customers (see the start of these Terms). Enterprise prices and terms are those of an executed order form or agreement (Section 17).

• Payment and invoices: subscriptions are paid in advance, monthly or yearly as you choose when you subscribe. Prices are set in euros; Stripe may show and charge the equivalent in your local currency. Paid plans are sold through Stripe’s Managed Payments service: Stripe, shown to you as Link, is the merchant of record for the payment. It charges your payment method, emails the receipts and invoices, and your statement shows LINK.COM* with our name. You enter card or other payment details on pages hosted by Stripe; they are not stored on our servers.
• Automatic renewal: a subscription renews automatically at the end of each billing period for another period of the same length, and the payment method on file is charged, until the subscription is cancelled.
• Cancellation: you can cancel at any time from the billing portal linked in the console, or from your Link account at link.com. Cancellation takes effect at the end of the billing period you have already paid for; the paid plan stays active until then, and the account then continues on the Free plan.
• Plan changes: an upgrade or downgrade takes effect as shown in the billing portal before you confirm it, including any prorated charge or credit it displays.
• Refunds: fees already paid are non-refundable and we do not refund or credit unused parts of a billing period, except where the law requires it or we agree otherwise in writing. As the merchant of record, Stripe (Link) may also issue a refund in some cases, for example to resolve a payment dispute.
• Failed payments: if a payment fails and is not resolved, we may cancel the subscription and move the account to the Free plan.
• Price changes: we may change the price of a paid plan by giving at least 30 days’ notice by email to the account owner. A new price applies from your first renewal after the notice period ends; if you do not agree, you can cancel before then.
• Taxes: prices exclude VAT, sales tax and similar taxes. As the merchant of record, Stripe calculates the tax that applies to you from your billing details, adds it at checkout, and collects and remits it. You are responsible for giving accurate billing and tax details.
• No retroactive charges: use of the Free plan, and any use before you subscribe, is never charged retroactively.

6. Free Plan

The Free plan is provided "as-is" for evaluation, development, and production use within its allowance (Section 4). We reserve the right to modify or discontinue the Free plan, including its allowance, with at least 30 days' notice. There are no SLA guarantees on the Free plan or on any self-serve paid plan; contractual service levels are available only in an executed enterprise agreement, and you may experience rate-limiting during high load periods.

7. Intellectual Property

All intellectual property rights in the Services, including but not limited to the Maskbreak API, SDK, dashboard, documentation, branding, and underlying machine learning models, remain the exclusive property of Sentinel Edge Networks LTD. These Terms do not grant you any ownership rights in the Services. Where an SDK or component is released under a separate open-source licence, that licence governs the rights it grants in that component.

You retain all rights to the data you submit to the API. You grant us a limited, non-exclusive license to process that data solely for the purpose of providing the Services.

8. Confidentiality

Each party may receive confidential information from the other. Both parties agree to keep such information confidential using at least the same degree of care used for their own confidential information, and not to disclose it to third parties without prior written consent. This obligation does not apply to information that is publicly available, independently developed, or required to be disclosed by law.

9. Data Processing & GDPR

When you use the Services to evaluate your users, you normally act as controller and Maskbreak acts as processor under the UK GDPR and, where applicable, EU GDPR. Our Data Processing Addendum (DPA), including the Article 28 terms and applicable transfer safeguards, is published self-serve at maskbreak.com/dpa and forms part of these Terms when Maskbreak processes personal data on your behalf. A countersigned copy is available on request at support@maskbreak.com.

You are responsible for ensuring you have a valid legal basis to submit your end-users' data to our API, and for informing your end-users of such processing in your own privacy policy. This includes deciding whether rules on storing or accessing information on your end-users’ devices (such as the UK Privacy and Electronic Communications Regulations or the EU ePrivacy Directive) require consent before our browser SDK runs on your site, and obtaining it where they do. The storage the SDK uses is listed at maskbreak.com/integrations#sdk-storage. (For accounts created before 28 September 2026, this applies only 14 days after we email the account owner about it.)

Data Retention: Account data is retained for the duration of your account. Account deletion removes personal data and API keys from live systems promptly. Our existing commitment is that encrypted disaster-recovery backups expire within 60 days and are not used to restore a deleted account. The current retention-assurance note describes the implementation review; it does not extend that commitment. Data may be retained longer only where required by law, to resolve a dispute, or to establish or defend legal claims.

Your Right to Erasure: You may request deletion of your account and all associated personal data at any time by emailing support@maskbreak.com or using the account deletion option on the Security page of the console (/security). We will respond without undue delay and normally within one calendar month. Where the law permits an extension because of the complexity or number of requests, we will explain the reason within the initial month. Erasure is subject to applicable legal exceptions; see the Privacy Policy.

10. Disclaimer of Warranties

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, OR NON-INFRINGEMENT. MASKBREAK DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.

Bot detection and fraud prevention are probabilistic by nature. Maskbreak does not guarantee that all bots will be detected or that no legitimate users will be flagged. You are responsible for how you act upon our risk scores in your application.

11. Limitation of Liability

Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, breach of title, or any other liability that cannot lawfully be excluded or limited. Subject to those carve-outs and to the maximum extent permitted by law, Maskbreak's total cumulative liability arising out of or related to these Terms or the Services shall not exceed the greater of (a) the fees paid by you to Maskbreak in the three months preceding the claim or (b) £100.

IN NO EVENT SHALL MASKBREAK BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, BUSINESS, OR GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

12. Indemnification

You agree to defend, indemnify, and hold harmless Maskbreak and its officers, directors, employees, and agents from any claims, damages, losses, liabilities, and expenses (including reasonable legal fees) arising out of or related to: (a) your use of the Services in violation of these Terms; (b) your violation of any applicable law; (c) your infringement of any third-party rights.

13. Term & Termination

These Terms remain in effect as long as you use or access the Services. You may terminate your account at any time from the Security page of the console or by emailing support@maskbreak.com. Closing the account cancels any paid subscription at once, and, as Section 5 says, the unused part of the billing period is not refunded; to use the period you have paid for, cancel from the billing portal first and close the account when that period ends. We may suspend or terminate your account immediately for breach of these Terms or any activity we reasonably believe is harmful to Maskbreak or other users.

Upon termination, your right to access the Services ceases immediately. Provisions that by their nature should survive termination (including Sections 7, 10, 11, 12, and 15) shall survive.

Before terminating a non-suspended account, you may export the account and usage information made available in the dashboard. We may retain limited records after termination only as described in our Privacy Policy.

14. Changes to Terms

We may update these Terms from time to time. We will notify you of material changes by email to your registered address at least 14 days before they take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Terms.

15. Governing Law & Dispute Resolution

These Terms are governed by and construed in accordance with the laws of England and Wales, without regard to conflict-of-law principles.

Any dispute arising from or related to these Terms shall first be subject to good-faith negotiation. If unresolved within 30 days, disputes shall be submitted to the exclusive jurisdiction of the courts of England and Wales.

16. Miscellaneous

• Entire Agreement: These Terms, together with our Privacy Policy, Cookie Policy and (where Maskbreak processes personal data on your behalf) the DPA, constitute the entire agreement between the parties regarding the Services.
• Severability: If any provision is found invalid or unenforceable, the remaining provisions remain in full force.
• Waiver: Failure to enforce any provision shall not constitute a waiver of future enforcement rights.
• Assignment: You may not assign your rights under these Terms without our written consent. We may assign our rights freely.
• Language: These Terms are executed in English. In case of conflict between any translated version and the English version, the English version prevails.
• Order of precedence: an executed order form or MSA prevails over these Terms for its subject matter, followed by the DPA for personal-data processing and an executed SLA for service levels.

17. Procurement & Enterprise Contracts

For procurement, security, or legal review teams, the following documents are available — self-serve where linked, otherwise on request from support@maskbreak.com:

• Data Processing Agreement (DPA) aligned to UK GDPR / EU GDPR Article 28, including the applicable international-transfer terms — published self-serve at /dpa, with a countersigned copy available on request. The current sub-processor list, with each provider’s region, is published at /sub-processors, where network- and device-intelligence providers are identified by category; the named list is available to customers on request under the DPA. Our Cookie Policy separately describes the providers used by the public website.
• Vendor security questionnaire responses (including answers to common SIG-Lite, CAIQ, and bespoke questionnaires).
• Master Services Agreement (MSA) for customers requiring contracting outside our standard click-through Terms.
• Service-level expectations. Our public service-level objectives are non-contractual on the Free plan and on self-serve paid plans. Contractual availability, support targets, and service credits are available only in an executed enterprise agreement. We will give 30 days' notice before any change to commercial terms.
• Sub-processor change notification: we will notify customers at least 30 days before adding or replacing a sub-processor that processes customer data, by a dated entry in the change log on /sub-processors, with a right to object before the change takes effect.
• Audit posture: Maskbreak is pre-audit for SOC 2 Type II. We do not currently hold SOC 2, ISO 27001, HIPAA BAAs, or PCI DSS attestation, and we will not claim otherwise. We will publish the audit firm and scope when an engagement is signed.
• Vulnerability disclosure: see our Responsible Disclosure policy for how to report security issues, scope, and safe-harbour commitments.

18. Contact