Terms

HourBack Terms of Service

The terms for organizations using HourBack: the website, the desktop app, pilots, subscriptions, and the reports and services that come with them.

Effective date: October 28, 2026

1. Who we are and how these terms apply

HourBack is provided by WonderWorks Group, LLC, a Wyoming limited liability company ("HourBack," "we," "us," or "our"), 30 N Gould St, Ste R, Sheridan, WY 82801, United States. Contact us at legal@hourback.io.

These Terms govern our website, desktop app, pilots, subscriptions and related reports and services (the "Services"). "Customer" means the organization purchasing or subscribing to the Services. "Authorized Users" are people the Customer authorizes to use them. A "Participant" is a person whose workplace activity or questionnaire responses are included in a pilot or other agreed engagement.

These Terms form a binding agreement between HourBack and the Customer when the Customer accepts them, by any of these: selecting "I agree" or a similar option when creating an account, starting a pilot or subscribing online; signing or accepting an Order that references these Terms; or using paid Services after accepting them. Anyone accepting on behalf of an organization, including online, represents that they have authority to bind it, and the organization is the Customer. We keep a record of each acceptance, including the version of these Terms accepted, the account and the time.

Submitting a pilot or partner enquiry does not by itself place an order or create a payment obligation.

An employee's use of the app does not personally bind the employee to the Customer's payment, indemnification or other organizational obligations. Authorized Users must follow the applicable access, privacy and acceptable-use rules, which the Customer must make available to them. Website visitors may view public materials for lawful purposes; browsing the website does not create a paid service agreement.

2. Orders, scope and document priority

An "Order" is the Customer's selection of Services accepted online, such as a plan, pilot or subscription chosen at sign-up or checkout, or a mutually accepted order form or statement of work. Each Order identifies the Services, fees and term, and, where relevant, the participating teams, deployment, deliverables, customer dependencies, schedule, renewal arrangements, support and any implementation work. The plan details shown when the Customer accepts an online Order form part of that Order.

A pilot ordinarily assesses work patterns, gathers team input and produces agreed reports and recommendations. Its exact duration and deliverables are those in the Order. A pilot does not automatically become an ongoing subscription, and an agent blueprint does not include building or deploying an AI agent unless the Order says so.

A signed data processing agreement ("DPA") controls any conflict about personal-data processing. Subject to that, an Order overrides these Terms only where it expressly identifies the provision being varied; otherwise these Terms apply. A pilot charter may set the workplace scope and participant protections but cannot reduce the privacy commitments in these Terms, the Privacy Policy or a DPA. Purchase-order boilerplate does not amend the agreement without our express written acceptance.

The Privacy Policy describes our information practices and participants' rights, and these Terms do not authorize processing that contradicts it. A material expansion of collection or use requires the applicable notices, agreements and any legally required consent before it begins.

3. Service access and customer responsibilities

During the Order's term, we grant the Customer a limited, non-exclusive right to use the Services for its internal business purposes and to permit its Authorized Users to do so, subject to the Order and these Terms. Any delivery-partner or resale arrangement requires a separate agreement.

The Customer must provide accurate organizational information, maintain appropriate permissions and compatible devices, protect account credentials and promptly tell us about suspected unauthorized access. Where individual accounts are provided, each user must use their own credentials. The Customer is responsible for activity it authorizes or permits, but not for incidents caused by HourBack's own breach of its obligations.

We will provide the agreed Services with reasonable care and skill. Support hours, response commitments, availability targets and service credits apply only if included in an Order or service-level agreement. We may maintain and update the Services, but will not materially reduce agreed functionality or privacy protections during a paid term without agreement, or without the remedy in section 14.

4. Workplace deployment and participant protections

Before collection begins, the Customer must agree a pilot charter with its people and give them clear information about the purpose, scope, timing, controls, recipients and retention of pilot information. The Customer must obtain the permissions needed to install and run the app on the relevant devices and systems.

The Customer is responsible for establishing a lawful basis and meeting applicable workplace notice, consultation, labor, privacy and cross-border requirements. An employee's acknowledgment of a charter does not by itself establish legally valid consent or waive privacy rights. Deployment outside the US must be reviewed and agreed with HourBack before collection begins.

The Customer must not:

Leaders receive reports only for groups of five or more people. Work done by fewer people is pooled rather than reported as an identifiable small group. Each Participant's individual report is private to them, and HourBack does not provide it to the employer or to other Participants. The Customer must respect these restrictions when sharing or combining outputs.

5. Information handling and AI

"Customer Data" means information supplied by or on behalf of the Customer or Participants, and work-activity information collected for the engagement. It includes confidential business information and personal information where present. Customer ownership does not give the Customer a right to a Participant's private report or to override that person's privacy rights.

What the app records, what it never keeps and how information is redacted are described in the Privacy Policy. In summary: the app writes its activity record on the Participant's computer, removes names and identifiers before anything is saved, and never keeps screenshots, recordings, keystrokes, passwords or clipboard contents. Excluded apps and sites, including chat, personal email and banking, are not recorded. Optional collection of choices in specifically listed dropdown fields must be disclosed in the charter. Questionnaire answers are redacted, including removal of names, before they are saved or processed by AI.

Participants can pause recording, use private mode or delete the last hour. Deleting the last hour removes it from the Participant's computer only; it does not remove information already included in analysis or reports. Other deletion requests follow the Privacy Policy and the Customer's request procedures.

The Customer permits us to process Customer Data only as needed to deliver, support and secure the agreed Services, to follow lawful documented instructions, and to meet legal obligations, subject to any DPA and the Privacy Policy. This is not a license to use Customer Data for unrelated purposes.

We use Anthropic's Claude API to process redacted work-activity information and redacted questionnaire answers. Our providers also include Cloudflare, Supabase and Google Workspace, as described in the Privacy Policy. Provider use remains subject to the agreed processing arrangements. Access to Customer Data at HourBack is limited to authorized personnel who need it to deliver the Services.

We do not use Customer Data to train AI models, combine one customer's data with another's to provide cross-customer insights, or use one customer's information to generate another customer's outputs. A provider's short-term retention for processing is different from model training; we do not promise zero provider retention unless it is expressly confirmed for the deployment.

Redaction and group reporting reduce risk but do not make every summary anonymous, and both parties must handle potentially identifying outputs accordingly. Where required, a DPA and deployment-specific processing details must be agreed before the relevant collection begins.

6. Sensitive information and customer-hosted deployments

The Customer must configure the agreed exclusions and must not deliberately submit passwords, financial-account credentials, government identifiers, health records or other sensitive case details. Free-text answers should describe processes without naming clients or including unnecessary personal information. These restrictions do not excuse HourBack from its own redaction or security obligations.

The Services are not a system for storing protected health information or other specially regulated records unless expressly covered by a separate written agreement with the required safeguards. No HIPAA business associate agreement or regulatory certification is implied.

If an Order provides for a customer-hosted deployment, it must allocate responsibility for hosting accounts, regions, costs, permissions, security, backups, exports and deletion. Customer hosting does not remove HourBack's obligations for processing under its control, and does not mean every AI or infrastructure provider operates in the same environment or country.

7. Acceptable use

Do not use the Services to violate law or others' rights, access systems without authorization, introduce malicious code, disrupt the Services, bypass access controls, or disclose confidential information without permission. Do not sell, sublicense or expose the Services to third parties except as agreed. Restrictions on reverse engineering apply only to the extent permitted by law.

Do not publish private reports or sensitive outputs without the appropriate permission. Nothing in these Terms prohibits lawful reporting to regulators, protected whistleblowing, exercising employment rights, or good-faith security or privacy reports.

8. Fees, invoices and renewal

Fees, billing frequency, payment method and the service term are stated in the Order. Online subscriptions are charged to the payment method the Customer provides, at the start of each billing period unless the Order says otherwise. Where we invoice, invoices are due 30 days after receipt unless otherwise agreed. Fees exclude applicable transaction taxes, which the Customer is responsible for, other than taxes on HourBack's income.

Tell us promptly about a good-faith billing dispute and pay undisputed amounts when due. We will work to resolve disputes before suspending service for nonpayment. No late charge or collection fee applies unless expressly agreed and legally permitted.

An Order renews automatically only if it clearly states, before the Customer accepts it, that it renews, the renewal term, the charges or pricing method, the cancellation deadline and how to cancel, and the Customer affirmatively agrees. Otherwise renewal requires agreement. Subscriptions accepted online can be cancelled online, effective at the end of the current billing period. We will not convert a pilot into a paid recurring service without express authorization. Cancelling a renewal does not by itself end a term already committed to.

Unless the Order or applicable law provides otherwise, fees for services properly delivered are not refundable, and early cancellation does not remove committed fees. This does not limit the refunds expressly provided in these Terms. Price changes apply only to a future agreed term, or as the Order expressly allows with the required notice.

9. Customer Data and deliverable rights

As between the parties, the Customer and its licensors keep their rights in Customer Data, subject to Participants' rights and the privacy protections above. We acquire no ownership of Customer Data by processing it.

"Deliverables" are the final reports, process maps, training guides and agent blueprints specifically identified for delivery in the Order. Once the applicable fees are paid, we assign to the Customer our transferable rights in the customer-specific portions of those Deliverables, excluding HourBack Materials and third-party materials. This does not transfer Participants' private reports to the Customer, or guarantee that AI-generated material is copyrightable or exclusive.

"HourBack Materials" means our pre-existing or independently developed software, models, methods, templates and general tools, and improvements to them that contain no Customer Data or customer-specific confidential information. We keep those rights. Where HourBack Materials are embedded in paid Deliverables, we grant the Customer a perpetual, worldwide, non-exclusive, royalty-free license to use, reproduce and adapt them as part of those Deliverables for its internal business, including sharing them with contractors under confidentiality obligations to implement the recommendations. This does not include source code or permit resale of HourBack Materials on their own.

Third-party components remain subject to their licenses, which we will identify where relevant. We may use feedback you choose to give without compensation, but feedback is not a license to use Customer Data or confidential examples for unrelated purposes.

10. Confidentiality

Each party must protect the other's nonpublic business, technical and personal information disclosed in connection with the Services, with reasonable care and at least the care it uses for comparable information of its own. Use is limited to performing or receiving the Services and exercising rights under the agreement, and access is limited to people and permitted providers who need it and are bound by appropriate confidentiality obligations.

Confidential information excludes information the recipient can show was lawfully public, already known without restriction, independently developed without using the disclosure, or lawfully obtained without a duty of confidentiality. These exceptions do not override restrictions on processing personal information.

A party may make legally required disclosures, limited to what is required, with advance notice where legally permitted. Nothing restricts protected disclosures or reporting suspected violations to an appropriate authority.

Confidentiality obligations continue for three years after termination; trade secrets stay protected for as long as the law protects them, and personal information for as long as it is retained. We will not use the Customer's name or logo in marketing without permission.

11. Outputs, estimates and implementation

Reports may contain estimates, incomplete classifications or AI-generated inaccuracies. Time savings, cost savings, implementation effort and future results are estimates, not guarantees. The Customer must review outputs against its own systems and operations before relying on them.

The Customer is responsible for implementation choices and must test automations, keep appropriate human approvals and obtain specialist advice where needed. An agent blueprint does not authorize an agent to act in production. HourBack will not deploy an automation or change production systems unless the Order expressly covers that work and the Customer authorizes the relevant access and actions.

The Services do not provide legal, employment, tax, insurance or other regulated professional advice. Public sample reports use illustrative, synthetic data and do not promise any particular outcome.

12. Security and incidents

Each party must maintain reasonable safeguards for the information and systems under its control. HourBack remains responsible for the providers it uses to meet its own obligations, subject to any DPA. Responsibilities for customer-selected infrastructure must be set out in the Order.

If we become aware of unauthorized access to or disclosure of Customer Data in systems under our control, we will notify the Customer without undue delay, share the material information available and reasonably cooperate in containment and response, subject to applicable law and any DPA. No system is guaranteed to be completely secure.

The Customer must promptly report suspected compromise or unintended collection to privacy@hourback.io and cooperate in preventing further exposure.

13. Retention, export and deletion

An active client is a Customer with an ongoing agreement or subscription for HourBack Services. A completed pilot or past purchase alone does not create an ongoing relationship after the relevant agreement or subscription ends.

We keep process summaries, final team reports, training guides and other agreed Deliverables while the Customer is an active client, unless earlier deletion is requested, to support the Services, ongoing comparisons and follow-up work.

When that relationship ends, we provide a 30-day export window for the Customer's process summaries and final Deliverables, in an ordinarily usable format, subject to reasonable identity verification and restrictions needed to protect others' information. The Customer has no right to export Participants' private reports.

We then delete active copies in HourBack-managed systems within the following 60 days, no later than 90 days after the relationship ends. Backups expire within 30 days after that. When a Customer asks for earlier deletion, we delete the requested active copies within 30 days, subject to lawful exceptions and to third-party processing described in the Privacy Policy or a DPA.

Only records specifically needed for a legal obligation, dispute or security incident may be kept beyond these periods, with restricted access, for the documented period needed. Contract and accounting records follow their own schedule. These exceptions do not justify keeping pilot activity indefinitely.

Activity records on Participants' computers, questionnaire answers and HourBack's working copies of private reports are deleted at the end of each pilot or customer subscription, as described in the Privacy Policy. The Customer is responsible for copies it downloads or keeps in its own systems, and an Order for a customer-hosted deployment must say how deletion is completed there. Ending the Services does not waive Participants' privacy rights.

14. Suspension and termination

We may suspend affected access when reasonably necessary to address a material security threat, unlawful use or material breach. For overdue undisputed fees, we will give at least 10 days' notice and an opportunity to resolve nonpayment before suspension. In other cases we will give notice and an opportunity to remedy where practicable, limit the suspension to what is necessary, and restore access promptly once the issue is resolved.

Either party may terminate an Order for a material breach not cured within 30 days after written notice, or immediately if the breach cannot reasonably be cured. A Customer may terminate the affected Services if HourBack materially reduces agreed functionality or privacy protections and does not remedy the reduction within that period. We may discontinue affected Services where legally required, with notice and mitigation where possible.

If the Customer terminates for our uncured material breach, or we end a paid Order for our convenience or because we can no longer lawfully provide it through no fault of the Customer, we will refund prepaid fees for the unused portion. Otherwise payment obligations are governed by the Order and section 8.

On expiry or termination, ordinary access ends, subject to the export window in section 13, and properly accrued unpaid fees remain due. Provisions intended to continue, including confidentiality, licenses to paid Deliverables, privacy obligations, deletion, liability and disputes, survive as applicable.

15. Service warranty and disclaimers

We warrant that we will provide the Services with reasonable care and skill and materially in accordance with the Order. Tell us promptly about a material failure so we can investigate and correct or redo the affected work. If it is not remedied within a reasonable period, the Customer may use the termination and refund remedy in section 14.

Except for express commitments in the agreement and rights that cannot legally be excluded, the Services and AI-generated outputs are provided without implied warranties of merchantability, fitness for a particular purpose or noninfringement. We do not promise uninterrupted service, error-free outputs or any particular financial result. These disclaimers do not override our express privacy, security, confidentiality or performance obligations.

16. Limits on liability

To the extent permitted by law, neither party is liable to the other for indirect, incidental, special, consequential or punitive damages, or lost profits, arising from the agreement. Reasonable direct costs of responding to a breach of confidentiality or data-security obligations are not excluded merely because they relate to a data incident.

Except for the exclusions and higher cap below, each party's total liability arising from the agreement will not exceed the greater of $1,000 or the fees paid or payable under the affected Order in the 12 months before the event giving rise to the claim. Related claims arising from the same events count together.

For a party's breach of its confidentiality, data-protection or data-security obligations, the total cap is twice the general cap, instead of (not in addition to) the general cap. The caps and exclusions do not apply to fraud, willful misconduct, gross negligence, the Customer's obligation to pay properly due fees, or liability that cannot lawfully be limited. These limits apply whatever the legal theory of the claim.

17. Third-party claims

These Terms impose no broad indemnification obligation. Any intellectual-property infringement defense, indemnity or other allocation of third-party claims must be expressly stated in the Order. Neither party may bind the other to a settlement without its written consent.

18. Governing law and disputes

The agreement is governed by Wyoming law, without regard to its conflict-of-laws rules, except that mandatory laws that cannot be excluded still apply. The parties will first try in good faith to resolve a dispute through their designated contacts for 30 days after written notice. This does not prevent urgent relief to protect confidential information, security or intellectual property, or require anyone to delay a legally protected complaint.

Unresolved disputes will be brought in the state courts in Sheridan County, Wyoming, or, where federal jurisdiction exists, the United States District Court for the District of Wyoming, and each party consents to those courts, subject to rights that cannot be waived. These Terms do not require arbitration or waive any right to a jury trial or to take part in a class proceeding.

19. Changes and general provisions

We may update public website materials from time to time. Changes to these Terms do not retroactively change an Order or materially alter an existing paid commitment merely by posting a new version. Material changes to an existing agreement require express acceptance (for example, accepting the updated Terms online), or take effect at a renewal after clear advance notice and an opportunity not to renew. Changes required by law will be handled with appropriate notice and any available termination rights.

The agreement consists of these Terms, accepted Orders and applicable signed agreements such as a DPA. If a provision is unenforceable, the rest continues to the extent lawful. Delay in enforcing a provision is not a waiver. Neither party is the other's agent, partner or employer.

Neither party may assign the agreement without the other's consent, not to be unreasonably withheld, except in a merger or sale of substantially all relevant assets to a successor that assumes the obligations. Assignment does not authorize broader use of Customer Data or remove privacy protections.

Neither party is responsible for delay caused by events beyond its reasonable control if it promptly notifies the other and takes reasonable steps to mitigate. This does not excuse safeguards within its control, accrued payment obligations, or reasonable data-protection and export assistance. If such an event materially prevents the Services for more than 30 days, either party may terminate the affected Order, and prepaid fees for unused service will be refunded.

Contract notices go to the contacts designated in the Order; notices to HourBack may be emailed to legal@hourback.io. If delivery fails, use another reasonable method, including the postal address below. Service of process follows applicable law.

20. Contact

WonderWorks Group, LLC (HourBack)
30 N Gould St, Ste R, Sheridan, WY 82801, United States
legal@hourback.io · hourback.io