Terms of service

Last updated 10 October 2026

These terms are the contract between Webhooks Ltd, trading as How’s that?, and the business that uses How’s that?. Please read them, particularly the acceptable use rules and clause 20, which limits our liability.

The short version

A plain summary to help you find your way. It isn’t part of the contract: if anything here differs from the full terms below, the full terms apply.

• How’s that? is for businesses. By signing up you confirm you’re acting for a business, not as a consumer.
• You own your content. We only use it to run the service for you.
• Only review websites you own or have permission to review. No phishing, scraping, load testing or getting round anyone’s security. We can block sites and suspend accounts that break these rules.
• You’re responsible for the guests you invite, and for any AI agents and services you connect.
• You can try everything for 14 days without a card. Your price won’t go up while you stay on your plan. If you’re new, you can get your first payment back within 30 days.
• You can cancel at any time. Cancelling takes effect at the end of the period you’ve paid for.
• We aim to keep How’s that? running, but we don’t promise it will always be available, and there’s no service level agreement.
• Our liability is limited to the greater of £100 and what you paid us in the previous 12 months. We aren’t liable for indirect losses, lost profits or lost data. Keep your own copies of anything important.
• Where we handle personal data in your content, we do it as your processor, under the data processing terms in Schedule 1.
• English law applies, and disputes go to the courts of England and Wales.

1. About these terms

1.1How’s that? is provided by Webhooks Ltd, a company registered in England and Wales with company number 16791194, whose registered office is at 8 Cedar Way, Tonyrefail, Porth, CF39 8JN, Wales (“we”, “us”, “our”). Our VAT number is GB 506 3225 24.

1.2“You” and “customer” mean the business that creates an account or orders a plan. The person who accepts these terms on its behalf confirms they have authority to bind it.

1.3In these terms:

• “Service” means How’s that?: the web app at app.howsthat.design, the browser extension, the review sidebar, web mode, journeys, the MCP server for AI agents, integrations, and any related software, sites and support we provide;
• “User” means a person you allow to use the Service under your account, such as an employee or contractor;
• “Guest” means a person who comments through a review link you share, without their own account;
• “Agent” means an AI agent or other software that you, or a User, connect to the Service, for example through the MCP server;
• “Customer Content” means everything you, your Users, Guests and Agents put into the Service, or that the Service captures for you: comments, replies, screenshots, journeys, page addresses, browser details, project settings and data received from integrations;
• “Review Proxy” means the parts of the Service that load a website through our servers so it can be reviewed without the extension, including web mode and review links that use it;
• “Plan” means the subscription you choose, as described on our pricing page when you choose it;
• “Fees” means the charges for your Plan.

1.4The contract starts when you create an account or, if earlier, first use the Service. It is made up of these terms, the data processing terms in Schedule 1 and the Plan you choose. If they conflict, Schedule 1 takes priority on personal data, then these terms, then the Plan details.

1.5Our privacy notice explains how we handle personal data as a controller. It is not part of this contract.

2. Who can use How’s that?

2.1The Service is for businesses only. By accepting these terms you confirm that you are acting for the purposes of a trade, business, craft or profession, and not as a consumer. Consumer protection law that applies only to consumers, such as the Consumer Rights Act 2015, does not apply to this contract.

2.2Users must be at least 18 years old.

2.3You must not use the Service if you are barred from receiving it under the laws of the United Kingdom or any other country that applies to you, including sanctions laws.

3. Accounts and admins

3.1You must give accurate information when you sign up and keep it up to date, including a working email address for notices.

3.2Your admins control your account. They can add and remove Users, change permissions, connect integrations and delete content. You are responsible for choosing your admins and for what they do.

3.3Each User must have their own sign-in. Sign-ins must not be shared. You must keep passwords and access tokens secure, and you are responsible for all activity under your account, unless it results from our breach of these terms.

3.4You must tell us promptly at [email protected] if you believe your account has been accessed without permission. You can revoke sign-ins and Agents yourself on the Connected apps page.

3.5You are responsible for your Users complying with these terms, as if their acts and omissions were your own.

4. Guests

4.1You may invite Guests to comment through review links. Anyone who has a review link can use it, so you must only share it with people you intend to review your site, and revoke it if it gets out.

4.2You are responsible for the Guests you invite, for their compliance with the acceptable use rules in clause 10, and for what they submit. What Guests submit is Customer Content.

4.3You are the controller of Guests’ personal data. You must tell Guests how their data will be used and have a lawful basis for collecting it.

5. Plans, the trial and the Free plan

6. Fees, billing and tax

7. Price lock

8. Refunds

9. Changing plan and cancelling

9.1You can cancel a paid Plan at any time from your account’s billing page, or by emailing [email protected]. Cancellation takes effect at the end of the billing period you have paid for, and your paid features continue until then.

9.2If you upgrade, the new Plan starts straight away and we charge the difference for the rest of the billing period. If you downgrade, the change takes effect at the start of your next billing period.

9.3Downgrading or cancelling may reduce the features and limits available to you. It is your responsibility to check the effect before you do it.

10. Acceptable use

10.1You must only use the Service to review websites that you own or operate, or that the owner has authorised you to review. For example, a studio may review its client’s staging site, staging.ambridge-physio.example, because the client has asked it to. Authorisation must cover the way you use the Service, including loading the site through the Review Proxy, capturing screenshots and recording journeys.

10.2You must not, and must not let anyone else, use the Service to:

1. load, frame, copy or capture a website you are not authorised to review, or use web mode or any other part of the Review Proxy against a site without the owner’s permission;
2. create or host phishing pages, or collect passwords, payment details or other credentials from anyone;
3. impersonate any person, business or website, or make a proxied or snapshot page look like the original site in order to deceive anyone;
4. distribute malware, or any code designed to damage, interfere with or gain unauthorised access to systems or data;
5. scrape, crawl or harvest content or data from websites, or from the Service, by automated means, other than through the features we provide;
6. get round access controls, paywalls, authentication, rate limits, IP restrictions or other security measures, on the Service or on any website;
7. load-test, stress-test or send unusually high volumes of requests to the Service or to any website through it;
8. probe, scan or test the vulnerability of the Service without our written permission;
9. reach private networks, internal addresses or cloud metadata services through the Review Proxy, other than private hosts that your admin has added to a project’s allowlist for sites you are authorised to review;
10. store, share or display content that is unlawful, infringes anyone’s rights, or is defamatory, harassing, hateful or obscene, or sexual content involving minors in any form;
11. process special category data or criminal offence data, unless it appears incidentally on a page you are authorised to review and you have a lawful basis for it;
12. send spam, or use review links to contact people who haven’t asked to take part;
13. resell, sublicense or provide the Service to third parties as a standalone service, except to your own clients as part of your work for them;
14. copy, reverse engineer or decompile the Service, except to the extent the law allows despite this restriction, or use it to build a competing product;
15. break any law or regulation.

10.3You must use reasonable measures, such as the data-annotate-mask attribute and the journey form-value options, to stop sensitive information on pages you review being captured where it isn’t needed.

10.4To protect the Service, the sites reviewed through it and other customers, we may, without notice where reasonably necessary:

1. block domains, addresses or networks from the Review Proxy and journey snapshots;
2. remove or disable access to Customer Content that we reasonably believe breaks this clause 10;
3. apply or change rate limits and usage limits;
4. suspend Users, Guests, Agents or your account under clause 16.

10.5If someone tells us that you are reviewing their site without permission, we may share your account’s contact details with them, or ask you to show that you are authorised, where it is reasonable and lawful to do so.

10.6Please report security problems or abuse to [email protected].

11. Your content

11.1You keep all rights in your Customer Content. We claim no ownership of it.

11.2You grant us a non-exclusive, worldwide, royalty-free licence to host, copy, process, transmit and display Customer Content only as needed to provide, secure and support the Service for you, to follow your instructions (for example, sending it to an integration you connect), and to comply with the law. The licence ends when the content is deleted under clause 17.

11.3Screenshots, snapshots and journeys can contain content from third-party websites, such as text, images, trade marks and personal data. You are responsible for having the rights and permissions needed to capture and use that content, and for its use.

11.4You confirm that your Customer Content, and our use of it under these terms, will not infringe anyone’s rights or break any law.

11.5We don’t monitor Customer Content, but we may look at it when you ask us to help, when we need to for security or to investigate a breach of clause 10, or when the law requires.

11.6The Service is not a backup or archive. You are responsible for keeping your own copies of any Customer Content you need.

11.7We may produce aggregated statistics about use of the Service, such as numbers of comments or projects, that don’t identify you, your Users or any individual, and use them to run and improve the Service.

12. Personal data

12.1When we process personal data in Customer Content, you are the controller and we are your processor. Schedule 1 applies to that processing.

12.2When we process personal data about you and your Users to manage your account, bill you and run our business, we are the controller, as described in our privacy notice.

12.3You must make sure you have a lawful basis to collect and share the personal data in Customer Content, and that people whose data is captured, including Users and Guests, have been given any information the law requires.

13. AI agents and integrations

13.1You can connect Agents and third-party services, such as Linear, to the Service. When you or a User connects one, you authorise us to give it access to the data and actions you approve, and to send it Customer Content on your behalf.

13.2You are responsible for each Agent and service you connect: choosing it, the access you give it, what it does with that access, and its outputs. That includes replies an Agent posts and threads it resolves or reopens in your name. You should review what Agents do and revoke access you no longer need.

13.3Data an Agent reads goes to the provider behind it. Third-party services and AI providers are governed by their own terms and privacy policies, under your own agreement with them. They are not our sub-processors.

13.4We don’t control third-party services and are not responsible for them: their availability, security, accuracy, what they do with data, or changes to how they work. We may stop supporting an integration if the third party changes or withdraws its service, or if we reasonably believe it creates a security risk.

13.5Content written by people, including comments from Guests, may contain instructions aimed at an Agent. We label it as untrusted when we pass it to Agents, but we can’t guarantee how an Agent will behave. Outputs from AI systems can be wrong, and you should check them before relying on them.

14. Our intellectual property and feedback

14.1We and our licensors own the Service, including its software, design, documentation and the How’s that? name and logo. Apart from the right to use the Service under these terms, you get no rights in it.

14.2We grant you a non-exclusive, non-transferable right, for the length of the contract, for your Users to use the Service, and to install the browser extension on their devices, for your internal business purposes and your work for your clients.

14.3Some parts of the Service include open-source software, which is licensed under its own terms.

14.4If you give us suggestions or feedback about the Service, we may use them freely without any obligation to you.

15. Availability, changes and beta features

15.1We aim to keep the Service available and working well, but we don’t guarantee that it will be uninterrupted, error-free or available at any particular time. We don’t offer a service level agreement or service credits.

15.2We may need to take the Service offline for maintenance. Where we can, we will do this at quiet times and give notice of planned work that we expect to cause significant disruption.

15.3Web mode and the Review Proxy work on a best-effort basis. They can only reach sites our servers can reach, and some sites won’t work through them.

15.4We improve the Service continually and may change, add or remove features. If we remove a feature that is material to your paid Plan, we will give you at least 30 days’ notice and, if you cancel because of it before it takes effect, we will refund the Fees you have paid for the rest of your billing period.

15.5Some features may be labelled beta, preview or experimental, or be switched on for some accounts only. They are provided as they are, may change or be withdrawn at any time, and clause 19.1 doesn’t apply to them.

15.6The browser extension depends on the browser and its extension store. We may require you to update to a recent version for the Service to keep working.

16. Suspension and termination

16.1You can stop using the Service and cancel at any time under clause 9. You can ask us to delete your account by emailing [email protected] from an admin’s address.

16.2We may suspend all or part of your access to the Service, immediately and without notice where reasonably necessary, if:

1. you, a User, Guest or Agent break clause 10, or we reasonably suspect it;
2. your use creates a security risk, or could harm the Service, other customers, or a third party, including the owner of a website reviewed through the Service;
3. Fees are overdue as described in clause 6.4;
4. the law, a court or a regulator requires it.

16.3We will tell you about a suspension and why, unless the law or a security need prevents it, and lift it once the reason has been resolved.

16.4We may end the contract by notice with immediate effect if you seriously or repeatedly break these terms and, where the breach can be put right, you don’t put it right within 14 days of being asked; or if you become insolvent, enter administration or liquidation, or stop trading.

16.5We may also end the contract for any other reason by giving you at least 30 days’ notice. If we do, we will refund the Fees you have paid for any period after the end date.

16.6When the contract ends, your right to use the Service stops, and clause 17 applies to your data. Clauses that by their nature should continue, including clauses 6 (for Fees already due), 11.3, 11.4, 17, 18, 20, 21, 24 and 25, continue after it ends.

17. Your data after cancellation

17.1If you cancel a paid Plan, your account moves to the Free plan at the end of your billing period. Your Customer Content stays readable, subject to the Free plan’s limits, until you or we delete it.

17.2If your account is deleted, at your request or because the contract ends, we will delete your Customer Content within 30 days. Deleted files can be recovered from storage for a further 7 days, after which they are gone.

17.3Before you delete your account, it is your responsibility to keep copies of any Customer Content you need. You can export each project’s comments and threads as JSON from its settings at any time. If you ask before the account is deleted, we will also provide a copy of other Customer Content, such as screenshots, in a commonly used format.

17.4We may keep information we are required to keep by law, such as invoices, and information about a suspension for abuse, for as long as we need it.

18. Confidentiality

18.1Each of us will keep the other’s confidential information confidential, use it only to perform this contract, and share it only with employees, contractors and advisers who need it and are bound by similar duties. Customer Content is your confidential information.

18.2This doesn’t apply to information that is or becomes public through no fault of the receiving party, that it already had or independently developed, or that it receives lawfully from someone else. Either of us may disclose confidential information where the law, a court or a regulator requires it, giving the other notice where allowed.

19. Warranties

19.1We will provide paid Plans with reasonable care and skill.

19.2The Free plan, trials and beta features are provided “as is”.

19.3Except as set out in these terms, and to the extent the law allows, we give no other warranties, conditions or terms, whether express or implied by statute, common law or otherwise, including as to satisfactory quality, fitness for a particular purpose or that the Service will meet your requirements.

19.4You confirm that you have the authority to accept these terms for your business, and that you will comply with clause 10.

20. Limitation of liability

20.1Nothing in these terms limits or excludes either party’s liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law.

20.2Subject to clause 20.1, we are not liable to you, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any:

1. indirect or consequential loss;
2. loss of profits, revenue, sales or business;
3. loss of contracts or business opportunity;
4. loss of goodwill or damage to reputation;
5. loss of anticipated savings;
6. loss, corruption or destruction of data, including Customer Content. You should keep your own records of anything important, as clause 11.6 says;
7. loss caused by an Agent or third-party service you connected, or by a breach of these terms by you, your Users or Guests.

20.3Subject to clause 20.1, our total aggregate liability to you arising out of or in connection with this contract, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the greater of £100 and the total Fees you paid us in the 12 months before the event giving rise to the claim.

20.4Clause 20.2 also limits your liability to us, but it does not limit your obligation to pay Fees or your liability under clause 21.

20.5We have set our prices on the basis of these limits. You accept that they are reasonable, given that the Service is offered to businesses at a low price, that you can choose what to put into it, and that you can protect yourself by keeping copies of your data and by insurance.

20.6Any claim against us must be brought within one year of the date you became aware, or ought reasonably to have become aware, of the facts giving rise to it.

21. Your indemnity

21.1You will indemnify us, and keep us indemnified, against all losses, damages, fines, costs (including reasonable legal fees) and expenses arising from any claim by a third party, or action by a regulator, that results from:

1. your Customer Content, or our use of it in line with these terms;
2. use of the Service by your Users, Guests or Agents, or by any third-party service you connect;
3. a breach of clause 10, including reviewing a website without the owner’s authorisation.

21.2We will tell you promptly about a claim, let you control its defence and settlement (provided you don’t admit liability for us without our agreement), and give you reasonable help at your cost.

22. Events outside our control

22.1Neither of us is liable for delay or failure to perform our obligations, other than paying money, caused by events beyond our reasonable control. These include failures of internet, hosting or power providers, cyber attacks we couldn’t reasonably have prevented, changes in law, acts of government, war, terrorism, civil unrest, fire, flood, pandemic and industrial action by others.

22.2The affected party will tell the other as soon as it can and take reasonable steps to limit the effect. If the event prevents the Service from being provided for more than 30 days in a row, either of us may end the contract by notice, and we will refund the Fees you have paid for any period after the end date.

23. Changes to these terms

23.1We may update these terms from time to time. We will give you at least 30 days’ notice of any material change by email to your account’s admins or in the app.

23.2If you don’t agree with a material change, you can cancel before it takes effect, and we will refund the Fees you have paid for the rest of your billing period. If you keep using the Service after the change takes effect, you accept the updated terms.

23.3We may make changes that aren’t material, such as clarifications, and changes required by law or needed urgently for security, with less or no notice. We will show the date of the latest change at the top of this page.

24. General

24.1Assignment. You may not transfer your rights or obligations under this contract without our written consent, which we won’t unreasonably withhold. We may transfer them to a company in our group, or to a buyer of our business or the part of it that provides the Service, and will tell you if we do.

24.2Subcontractors. We may use subcontractors to provide the Service. We remain responsible for them under this contract, and Schedule 1 governs those that process personal data.

24.3Entire agreement. This contract is the entire agreement between us about its subject and replaces any earlier agreement or understanding. Neither of us has relied on any statement or promise not set out in it, but nothing in this clause limits liability for fraudulent misrepresentation.

24.4Your terms. Any terms in your purchase order or other documents don’t apply, even if we accept the order.

24.5No waiver. If either of us delays or doesn’t enforce a right, we can still enforce it later.

24.6Severance. If a court finds any part of these terms invalid or unenforceable, the rest continues to apply, and the affected part applies with the minimum change needed to make it valid.

24.7Relationship. Nothing in this contract creates a partnership, joint venture or agency between us.

24.8Third-party rights. Only you and we have rights under this contract. No one else, including Users and Guests, may enforce any of its terms under the Contracts (Rights of Third Parties) Act 1999.

24.9Notices. We will send notices to the email address of your account’s owner or admins, or show them in the app. You can send notices to [email protected]. An email notice is treated as received when sent, unless the sender gets a message saying it wasn’t delivered. Notices of legal proceedings must be delivered by hand or by post to the other party’s registered office, not by email.

24.10Publicity. We won’t name you as a customer or use your logo without your permission.

25. Governing law and jurisdiction

25.1This contract, and any dispute or claim arising out of or in connection with it or its subject matter or formation, including non-contractual disputes or claims, is governed by the law of England and Wales.

25.2The courts of England and Wales have exclusive jurisdiction over any such dispute or claim. Before going to court, each of us will first try to resolve the dispute by discussing it in good faith, except where urgent relief is needed.

Schedule 1: Data processing terms

This schedule sets out the terms required by Article 28(3) of the UK GDPR for our processing of personal data in Customer Content on your behalf. Words such as controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meanings given in the UK GDPR. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018, PECR, and any other law about personal data that applies to the processing.

1. Roles and scope

1.1You are the controller, and we are the processor, of the personal data in Customer Content (the “Customer Personal Data”). Where you are yourself a processor for a client, we are your sub-processor, and you confirm your client has authorised you to appoint us.

1.2You are responsible for the lawfulness of the processing you instruct, including having a lawful basis and giving people the information the law requires.

2. Details of the processing

3. Instructions

3.1We will process Customer Personal Data only on your documented instructions, including about transfers to a third country, unless the law requires us to do otherwise. In that case we will tell you before processing, unless the law forbids it on important grounds of public interest.

3.2Your instructions are these terms, your use and configuration of the Service (for example connecting an integration or Agent, inviting a Guest or deleting content), and any other written instructions we agree. We will tell you straight away if we think an instruction breaks Data Protection Law.

4. Confidentiality

4.1We will make sure anyone we authorise to process Customer Personal Data is under a duty of confidentiality, by contract or by law, and only accesses it as needed to provide the Service, support you or keep the Service secure.

5. Security

5.1We will take the technical and organisational measures required by Article 32 of the UK GDPR, appropriate to the risk. They currently include encryption in transit, encryption of stored files at rest, private file storage that is only served after an access check, salted password hashing, sign-in rate limits and lockouts, short-lived and revocable access tokens, encrypted integration credentials, scoped and rate-limited access for Agents with an audit of their actions, and masking of password fields in screenshots.

5.2We may change these measures, as long as the overall level of security does not fall.

5.3You are responsible for the security of your accounts, for who you give access to, and for using the masking options described in clause 10.3 of the terms.

6. Sub-processors

6.1You give us general authorisation to use sub-processors. The current list is in the privacy notice.

6.2We will give you at least 30 days’ notice, by email to your admins or in the app, before we add or replace a sub-processor. You can object on reasonable data protection grounds within that period. If you do, we will work with you in good faith to find a solution. If we can’t, you may end the contract by notice and we will refund the Fees you have paid for any period after the end date.

6.3We will put in place a written contract with each sub-processor that imposes data protection obligations equivalent to those in this schedule. We remain liable to you for our sub-processors’ performance of those obligations.

6.4Integrations, AI providers and other services that you connect are not our sub-processors. We send them data on your instruction.

7. Data subject requests

7.1Taking into account the nature of the processing, we will help you, through appropriate technical and organisational measures where possible, to respond to requests from data subjects to exercise their rights. Much of this you can do yourself in the Service, for example by deleting comments or projects.

7.2If we receive a request directly that relates to Customer Personal Data, we will pass it to you without undue delay and won’t respond to it ourselves except to direct the person to you, unless you ask us to.

8. Other assistance

8.1Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under Articles 32 to 36 of the UK GDPR: security, notifying personal data breaches, data protection impact assessments and prior consultation with the ICO.

8.2We may charge reasonable costs for help that goes beyond what we provide to customers generally, unless the help is needed because we broke this schedule.

9. Personal data breaches

9.1We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

9.2As far as we can, the notice will describe the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed to deal with it. Where we can’t provide everything at once, we will provide it in stages without undue further delay.

9.3Notifying you of a breach is not an admission of fault or liability.

10. Deletion or return

10.1When the contract ends, at your choice we will delete Customer Personal Data or return it to you, as described in clause 17 of the terms, unless the law requires us to keep it. If you don’t tell us your choice within 30 days, we will delete it.

10.2Deleted files remain recoverable from storage for up to 7 days, after which they are permanently deleted.

11. Information and audits

11.1We will make available to you the information reasonably necessary to show that we comply with Article 28 of the UK GDPR, for example by answering a reasonable security questionnaire once a year.

11.2If that information isn’t enough to show compliance, or a supervisory authority requires it, we will allow and contribute to an audit or inspection by you or an independent auditor you appoint who is bound by confidentiality. You must give at least 30 days’ notice, audits may take place no more than once in any 12 months (unless after a personal data breach or at a regulator’s request), must be conducted during business hours without unreasonably disrupting our business or compromising other customers’ data, and are at your cost.

12. International transfers

12.1We will only transfer Customer Personal Data outside the UK, or allow a sub-processor to do so, where the transfer is covered by UK adequacy regulations or by appropriate safeguards under Article 46 of the UK GDPR, such as the ICO’s International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, and where we have assessed the transfer as the law requires.

12.2Transfers you instruct, by connecting an integration or Agent whose provider is outside the UK, are your responsibility as controller.

13. Liability

13.1Each party’s liability under or in connection with this schedule is subject to clause 20 of the terms.

See also our privacy notice and cookie notice. Questions about these terms: [email protected].