Terms of Service.

Effective date: September 28, 2026

Important. Read these Terms before you access or use any Rocksosint website, platform, API, content or output. By creating an account, using any Service, subscribing to a plan or clicking to accept, you agree to these Terms and to our Privacy Policy. If you do not agree, do not use the Services. Nothing in these Terms removes rights that the mandatory consumer or data-protection law of your country of residence gives you.

1. About us and these Terms

1.1. The Services are provided under the Rocksosint brand ("Rocksosint", "we", "us" or "our"), an open-source intelligence (OSINT) platform operated at rocksosint.com. Contact: [email protected].

1.2. These Terms of Service ("Terms") govern access to and use of every product and service we make available, including: (a) our public websites and other freely available online resources ("Website"); (b) the free plan, previews, trials and promotional access ("Free Services"); (c) our hosted platform, dashboard, search modules, Investigations workspace, notifications, reports and related features ("Platform"); (d) any application programming interface, key, connector or developer tool we make available ("API"); (e) institutional or enterprise services agreed in writing ("Institutional Services"); and (f) all documentation, content, results, exports and support supplied with any of the above. Together, the "Services".

1.3. If you use the Services for or on behalf of a company, public body, law-enforcement agency, non-profit or other organization ("Organization"), you confirm that you have authority to bind that Organization, and "you" includes the Organization.

1.4. If you are an individual using the Services in a personal capacity, the provisions on organizational accounts, API integrations and Institutional Services apply only to the extent relevant.

2. Definitions

3. Contract documents

3.1. The agreement between you and us consists of these Terms, the Privacy Policy, Annex I (Data Processing Addendum), the Plans page, any applicable Order and any document expressly incorporated by reference (together, the "Contract").

3.2. If they conflict, this order applies: (a) a signed Order or written institutional agreement; (b) Annex I, only for personal-data processing; (c) these Terms; (d) the Privacy Policy; (e) the Documentation.

3.3. Purchase orders, procurement portals and other customer documents are administrative only; additional or inconsistent terms in them are not part of the Contract unless we accept them in writing.

4. Eligibility and verification

4.1. You must be at least 18 years old and legally able to enter into the Contract. Registration information must be complete, accurate and kept current.

4.2. We may ask for identity, organization, professional-status, use-case, payment, sanctions or security information before or during access, and may limit, suspend or withdraw access where we reasonably consider that the user, Organization, jurisdiction, use case or risk profile is unsuitable, unlawful or likely to expose any person or system to harm.

4.3. Accepting a registration or activating a feature is not an assessment or approval of your lawful basis, authority or purpose.

5. Accounts and security

5.1. The Account is personal. You are responsible for all activity under it, including activity by Authorized Users and by anyone using your credentials, API keys or tokens, except to the extent caused by our breach of the Contract.

5.2. Do not share, transfer, publish or embed credentials in publicly accessible code. Use strong passwords, keep sessions under review and revoke devices you no longer use.

5.3. Tell us immediately at [email protected] if you suspect unauthorized access, credential compromise, a security weakness or misuse. We may reset, revoke or disable credentials and sessions where reasonably necessary to protect the Services, users or third parties.

6. Access rights

6.1. Subject to the Contract, we grant you a limited, non-exclusive, non-transferable, non-sublicensable and revocable right to access and use the Services, during the applicable access period, only for the Permitted Purpose.

6.2. No right is granted by implication. We and our licensors keep all rights in the Services, Documentation, software, methods, interfaces, compilations, design and branding.

6.3. Free Services may be withdrawn, restricted or changed at any time and, unless stated otherwise, come without support, service levels or continuity commitments.

7. Public website

7.1. You may view and use the Website for lawful personal, informational or internal business purposes, keeping proprietary notices and without presenting content misleadingly.

7.2. You must not use crawlers, scrapers, browser automation or similar means to access, copy, index, monitor or extract Website or Platform content, except through an API we provide for that purpose or with our written permission.

7.3. You may link to the Website fairly and lawfully, without suggesting endorsement. Do not frame, mirror or embed it.

7.4. Website content is general information, not legal, regulatory, financial or investigative advice.

8. Free plan and previews

8.1. The free plan is offered at our discretion, subject to usage limits, periodic revalidation and the Permitted Purpose. Unused free allowances expire at the end of the period and do not roll over.

8.2. Illustrative previews. Where the free plan shows a preview of a report, that preview demonstrates the structure and categories of a report and is not a real result of your query. Real Outputs are delivered on the paid plans.

8.3. A free trial or promotion converts to a paid subscription only where that consequence, the price and the cancellation method are clearly stated and accepted beforehand.

8.4. Beta and experimental features may be incomplete, changed or withdrawn at any time, and must not be used for evidential or legally significant purposes.

9. Plans, credits and payment

9.1. Plans, prices, Credits, limits and features are described on the Plans page and in your Account. An Order becomes binding when we accept it, including by activating the Service. Prices are in US dollars.

9.2. Card payments are processed by Stripe. We do not store full card details. A paid plan is released only after the payment provider confirms payment; a pending, disputed or reversed payment does not release access.

9.3. Credits are consumed per search as described in the Documentation and do not accumulate between periods. If a search fails because of a technical error on our side, the Credit is returned automatically. Credits have no cash value.

9.4. Subscriptions renew automatically for periods equal to the current one (monthly or annual) unless canceled before the renewal date. You can cancel at any time in your Account or in the billing portal; cancellation takes effect at the end of the period already paid, and no further charges are made.

9.5. We may change prices or plan composition with reasonable advance notice; changes take effect at the next renewal. Prices do not include taxes that may apply in your jurisdiction unless stated; you are responsible for bank, foreign-exchange and card fees charged by your own providers.

9.6. A chargeback, dispute or reversal suspends the related access immediately and may lead to closure of the Account.

9.7. Refunds. Fees for a period already started are not refundable, except (a) as stated in Sections 9.3, 21.2, 25.2 and 26.3, or (b) where the mandatory consumer law of your country of residence gives you a right of withdrawal or refund, in which case that right is honored. Where such a law allows a refund to be proportional to use, Credits already consumed are not refunded, because that part of the service was delivered. Refund requests go to [email protected].

9.8. Institutional agreements may set specific commercial terms (invoicing, seats, volumes); the Order prevails on those points.

10. Acceptable use

10.1. Use the Services only for a Permitted Purpose and in line with the Contract and all laws, regulations, professional duties and court orders that apply to you, including data-protection laws such as the EU and UK General Data Protection Regulations (GDPR) and the California Consumer Privacy Act (CCPA), where applicable.

10.2. Before submitting any identifier or other personal data of a third party, you must have a lawful basis, legitimate authority and a proportionate reason. You alone are responsible for the legality, necessity and fairness of each search, investigation, disclosure and later use.

10.3. Public availability is not, by itself, a lawful basis. Information being online does not give an unrestricted right to collect, correlate, disclose or keep it.

10.4. You must contextualize and corroborate Outputs, keep provenance where relevant, apply human judgment and keep appropriate records for sensitive or high-impact uses.

10.5. You must not use, or let anyone use, the Services:

1. for unlawful surveillance, stalking, harassment, intimidation, coercion, extortion, doxxing, identity theft, impersonation or targeting of any person without lawful authority;
2. to investigate, locate, profile or monitor children, or to obtain or expose data of a minor;
3. to discriminate unlawfully, persecute protected or vulnerable groups, suppress lawful expression or facilitate violence or abuse;
4. to make a solely automated decision with legal or similarly significant effects on a person, or to decide eligibility for employment, housing, credit, insurance, education, healthcare or immigration, without an independent lawful basis, verification and human review;
5. to obtain, infer or exploit sensitive personal data (such as health, sexual orientation, religion, political opinion, biometric or genetic data) where that is unlawful or disproportionate;
6. to investigate a person for a purely personal dispute, curiosity, revenge, romantic or domestic purpose that lacks a lawful basis;
7. to check, test or exploit credentials or accounts that are not yours or that you are not expressly authorized to verify;
8. for spam, credential attacks, phishing, malware, fraud, money laundering, sanctions evasion, terrorism or any other criminal activity;
9. to access non-public systems or data without authorization, or to bypass access controls, rate limits or security measures of the Services or of any Third-Party Source;
10. to test the vulnerability of any Service or Third-Party Source without written authorization; or
11. in any way likely to cause material harm to a person, compromise an investigation, contaminate evidence or create a false impression of certainty.

10.6. We may require additional approvals or controls for sensitive features. Breaking this Section may lead to immediate suspension or termination without refund, and to reporting to the competent authorities where the law requires it.

11. Technical restrictions

11.1. Unless the Contract or non-excludable law allows it, you must not:

1. copy, modify, reverse engineer, decompile or otherwise try to discover the source code, models or methods of any Service;
2. sell, rent, sublicense, white-label or otherwise commercialize the Services or raw Outputs as a standalone product;
3. use the Services or Outputs to build, train or benchmark a competing product, dataset or model;
4. bulk-download or build a persistent repository of Outputs beyond what the Permitted Purpose reasonably needs (the Investigations workspace is the supported way to keep Outputs);
5. remove or alter proprietary notices, source attribution, confidence indicators or warnings;
6. misrepresent the source, completeness, accuracy or meaning of an Output, or imply that we or any Third-Party Source endorse your conclusions;
7. share Accounts, exceed purchased Credits or limits, or get around free-plan limits with multiple Accounts;
8. interfere with, overload or degrade the Services, infrastructure, Third-Party Sources or other users' access.

12. Your data and searches

12.1. You keep ownership of Customer Data. You grant us and our subprocessors a limited right to host, transmit and process it only as needed to provide, secure, support and administer the Services, to comply with law and to enforce the Contract.

12.2. You confirm that you have all rights, notices, lawful bases and authority needed for us to process Customer Data under the Contract, and that doing so does not infringe any law or third-party right.

12.3. Searches and Outputs. Searches run at the time of the query and Outputs are delivered to your browser. They are not kept in your Account unless you save them to an Investigation, request an AI-generated analysis, or a late result is still arriving, as described in the Privacy Policy. The Services are not an evidential archive; export and keep anything you need.

12.4. Uploaded files. Files you upload are processed only to run the requested function and are not kept longer than that. We do not offer facial recognition or biometric identification; reverse image search compares visual content through a Third-Party Source and does not create biometric templates.

12.5. Investigations. Content you save to an Investigation is stored in your Account, isolated to you, until you delete it or the Account closes, subject to Section 25 and the Privacy Policy.

12.6. Usage Data. We use Usage Data to operate, secure, bill, support and improve the Services and to detect misuse. We do not use your searches, files or Outputs to identify your subjects for marketing, and we do not use Customer Data or Outputs to train artificial-intelligence models.

13. Outputs and independent verification

13.1. The Services retrieve, organize, correlate and analyze information from Third-Party Sources and open, public or commercially available sources. We do not control those sources and are not responsible for their availability, legality, accuracy or terms.

13.2. Outputs may be incomplete, delayed, duplicated, wrongly associated, changed or removed by a source, and may reflect homonyms, recycled identifiers or old information. An Output is a lead, not a verified finding or a statement about a person's identity, character, conduct or legal status.

13.3. Verify and corroborate material Outputs with appropriate sources, methods and human judgment before acting, publishing or making any decision that affects a person. You are responsible for the conclusions and actions you base on Outputs.

13.4. Rocksosint is not a consumer reporting agency under the US Fair Credit Reporting Act (FCRA) or a background-check company, and Outputs must not be used for decisions regulated by consumer-credit, employment-screening, tenant-screening or similar laws.

13.5. Links to Third-Party Sources do not imply affiliation or endorsement. Their own terms and restrictions may apply when you use them directly.

13.6. We may add, remove or change a source, module or feature at any time, including for legal, ethical, security or commercial reasons.

14. AI-generated analysis

14.1. If you request an AI-generated analysis, the Outputs of that search are processed by an artificial-intelligence model to produce a summary. It is automatically generated content that may contain errors, omissions or unfounded inferences, provided as an aid to your own analysis.

14.2. The analysis is not a decision, recommendation or professional opinion and must not be the only basis for any action that affects a person. Section 13 applies in full.

15. API

15.1. Where we offer an API, use it only through credentials we issue and in line with the Documentation, rate limits and versioning rules.

15.2. Any application connected to the API must have appropriate security and access controls, give its users clear terms and privacy information, keep API credentials private and preserve provenance, confidence indicators and warnings returned with Outputs.

15.3. Do not resell raw API Outputs, build a general-purpose identity repository or let end users query the API outside your controlled application unless an Order allows it.

15.4. We may change or retire an API, endpoint or field; where practicable we give advance notice of breaking changes to a paid API. We may monitor API usage to verify compliance, protect infrastructure and detect abuse.

16. Intellectual property

16.1. The "Rocksosint" name, wordmark, brand elements, Platform, software and texts are owned by or licensed to us. You may not use them, or register any domain, company name, product name, social handle or mark identical or confusingly similar to ours, without our written consent.

16.2. If you send us feedback, you grant us a worldwide, perpetual, royalty-free right to use it without obligation, provided we do not identify you publicly without consent.

16.3. Open-source components are subject to their own licenses, which prevail for those components where the license requires.

17. Confidentiality

17.1. Each party keeps the other's non-public business, technical, security, pricing or investigative information confidential, uses it only under the Contract and protects it with at least reasonable care. This does not cover information that is or becomes public without breach, was known lawfully beforehand, is received lawfully from a third party or is independently developed.

17.2. Confidential information may be shared with personnel, advisers and subcontractors who need it and are bound by equivalent duties, and where required by law or a court, with prompt notice where lawful.

17.3. Your non-public Customer Data, Investigations and notes are your confidential information. Our non-public Documentation, security information, methods and API credentials are ours.

18. Data protection roles

18.1. Each party complies with the data-protection laws that apply to it. Our processing of personal data about users, visitors and people who may appear in Outputs is described in the Privacy Policy.

18.2. Your Account data. For personal data about you as a user (registration, billing, sessions, usage), Rocksosint is the controller.

18.3. Data you submit to run searches. For personal data in Customer Data that we process only to run your query on your instructions, you are the controller and we are the processor. You decide, and are solely responsible for, the purpose, lawful basis, necessity and scope of your searches and later use, including notices, any required consents or impact assessments (DPIA) and data-subject requests about your purposes. Annex I applies automatically to this processing.

18.4. Our own processing. We are an independent controller where we decide the purposes and means, including account administration, billing, security, abuse prevention, legal compliance and handling requests from people who may appear in Outputs.

18.5. Where we receive a request that relates only to your purposes, we may refer the requester to you unless the law requires us to answer directly.

18.6. Where the GDPR applies to your use, you must identify and document an Article 6 lawful basis and, where applicable, an Article 9 or 10 condition before each relevant search. Our acceptance of a search is not a decision on your lawful basis.

19. Security

19.1. We use reasonable technical and organizational measures to protect the Services and personal data against unauthorized access, loss, alteration or disclosure. No system is completely secure.

19.2. You are responsible for the security of your devices, networks, applications, exports, credentials and copies of Outputs.

19.3. Neither party publicly discloses a vulnerability in the other's systems without first sharing details, allowing a reasonable fix period and coordinating disclosure. Security testing of the Services needs our written authorization.

20. Availability and changes

20.1. We provide paid Services with reasonable skill and care. Service levels apply only if stated in an Order. Current availability is published on the status page.

20.2. The Services may be unavailable because of maintenance, security events, cloud or network failures, Third-Party Sources or other events outside our reasonable control.

20.3. We may update or change the Services. For paid Services we use reasonable efforts not to materially reduce the core functionality you bought during the current period, except where required by law, security, ethics, source availability or prevention of harm.

20.4. Support is by e-mail and through the Platform, to the extent included in your plan.

21. Warranties and disclaimers

21.1. Each party confirms it has authority to enter into the Contract.

21.2. For a paid Service, we warrant that it will perform materially in line with the Documentation when used as authorized. If it does not, we will try to correct it; if we cannot within a reasonable period, you may end the affected Service and receive a pro-rata refund of prepaid fees for the unused period.

21.3. Free Services, beta features, Third-Party Sources and Outputs are provided "as is" and "as available". To the maximum extent permitted by law, we do not warrant that any Service or Output is uninterrupted, error-free, complete, accurate, current or suitable for a particular investigation, legal standard or outcome.

21.4. We do not warrant that an Output identifies a particular person, proves ownership of an account, establishes wrongdoing or is enough for enforcement, publication or a decision about a person.

21.5. Except as expressly stated and to the maximum extent permitted by law, all implied warranties are excluded. Nothing here limits guarantees owed to consumers under mandatory law.

22. Your indemnity

22.1. You will indemnify and hold Rocksosint, its staff and contractors harmless against third-party claims, regulatory actions, losses, damages, penalties and reasonable legal costs arising from: (a) Customer Data or your application infringing a third party's rights; (b) your or an Authorized User's unlawful, prohibited or unauthorized use of a Service or Output; (c) your publication, disclosure, decision or other use of an Output; (d) your breach of Sections 10, 11, 12, 15, 17, 18 or 19; or (e) a claim by a data subject, third party or regulator arising from your search instructions, purpose or lack of authority or lawful basis.

22.2. We will notify you of the claim promptly, let you control the defense with competent counsel and cooperate reasonably at your cost. You may not settle in a way that admits fault by us or binds us without our written consent.

23. Liability

23.1. Nothing in the Contract excludes or limits liability for death or personal injury caused by negligence, for fraud or willful misconduct, or any other liability that cannot lawfully be limited, including liability owed to consumers under mandatory law.

23.2. Subject to Section 23.1, neither party is liable for lost profit, revenue, business, savings, goodwill, reputation or data, or for any indirect or consequential loss, even if foreseeable.

23.3. Subject to Sections 23.1 and 23.4, our total liability arising out of or in connection with the Contract will not exceed: (a) for a paid Service, the fees you paid for the affected Service in the 12 months before the event giving rise to the first claim; and (b) for a Free Service or Website use, USD 100.

23.4. Your payment obligations and your liability under Section 22 are not limited by Section 23.3.

24. Suspension and termination

24.1. We may suspend or restrict access immediately where reasonably necessary to address suspected unlawful or prohibited use, a security risk, harm to a person or system, breach of limits, an overdue or reversed payment, a legal or sanctions requirement, or a material risk to us or another user. Where appropriate, we will tell you and give you a chance to fix the issue.

24.2. Either party may terminate the Contract by written notice if the other materially breaches it and does not fix a fixable breach within 14 days of notice. We may terminate immediately for a breach of Sections 4, 10, 11, 15, 17, 18 or 19, or where continuing would be unlawful or create a serious risk of harm.

24.3. You may stop using the Services and close your Account at any time in your Account settings. Closing the Account cancels any active subscription; fees for the current period are not refunded except as stated in Section 9.7.

24.4. We may end a Free Service at any time.

25. After termination

25.1. When access ends, stop using credentials, APIs and Documentation. We may disable Accounts and API keys.

25.2. You must pay amounts already due. If you terminate for our unfixed material breach under Section 24.2, we refund prepaid fees for the unused part of the affected paid Service.

25.3. Your content. When you close your Account, your Account data and saved content (Investigations, notes, AI-generated analyses, notifications) are deleted as described in the Privacy Policy. When a paid plan ends without closing the Account, Investigations become read-only and are deleted 180 days after the plan ends, unless you resubscribe or delete them sooner. Export anything you need before then.

25.4. You may keep lawfully retained Outputs that are part of your own case files, but you must keep complying with the law and with confidentiality, provenance, security and use restrictions.

25.5. Sections that by their nature should survive will survive, including Sections 11 to 13, 16 to 18 and 21 to 31.

26. Changes to these Terms

26.1. We may update these Terms to reflect changes in law, security, technology, the Services or our practices. We will publish the new version with its effective date and may notify you by e-mail or in your Account.

26.2. For Website use and Free Services, changes take effect on the stated date; continued use means acceptance.

26.3. For a paid period, a materially adverse change normally takes effect at the next renewal, unless an earlier change is reasonably required by law, security, ethics, a Third-Party Source or prevention of harm. If an earlier change materially reduces your rights and you object within 30 days of notice, you may end the affected Service and receive a pro-rata refund for the unused period.

27. Notices

27.1. You agree to receive communications about your Account and the Services electronically (e-mail and in-Platform notices), which have the same validity as written communications.

27.2. Formal notices to us go to [email protected]. Notices to you go to the e-mail address on your Account. An e-mail notice is received when sent without a delivery-failure message.

28. General provisions

28.1. Entire agreement. The Contract is the entire agreement on its subject and replaces prior proposals and discussions, without limiting liability for fraud.

28.2. Assignment. You may not assign or transfer your rights without our written consent. We may assign the Contract to an affiliate or in a merger, restructuring or sale of the business, provided your rights are not materially reduced.

28.3. Subcontracting. We may use subcontractors and remain responsible for their performance as the Contract requires.

28.4. Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control (other than payment obligations).

28.5. No partnership. The Contract creates no partnership, joint venture, employment or agency relationship.

28.6. Waiver and severance. Not exercising a right is not a waiver. If a provision is invalid, it is modified to the minimum extent needed, or removed, without affecting the rest.

28.7. Language. These Terms are written in English, and the English version controls.

29. Trade controls

29.1. Each party complies with the sanctions, export-control, anti-bribery and anti-money-laundering laws that apply to it.

29.2. You must not use the Services in or for a jurisdiction, person or end use prohibited by applicable sanctions or export controls.

29.3. We may refuse, suspend or end access without liability where we reasonably believe that providing it would breach a trade restriction.

30. Our commitments

Open-source intelligence is a discipline, not a shortcut. Our tools exist to support tradecraft, human judgment and lawful investigation.

We will: offer OSINT capabilities aligned with lawful, proportionate and legitimate need; show source provenance, limits and uncertainty wherever possible; keep channels for people who may appear in Outputs to exercise their rights, and act on verified requests; and keep reviewing our practices against legal and ethical expectations.

We will not: facilitate unlawful surveillance or targeting; hide data origins, limits or uncertainty; market OSINT as a replacement for due process and verification; support activities that undermine human rights or the rule of law; or put commercial outcomes ahead of ethical responsibility.

31. Disputes and applicable law

31.1. Before starting legal action, both parties will try to resolve any dispute in good faith by writing to [email protected]. Most concerns are resolved this way.

31.2. If you use the Services as a consumer, the mandatory consumer-protection and data-protection laws of your country or state of residence apply, and you may bring proceedings in the courts of your place of residence. Nothing in these Terms limits your right to complain to your local data-protection authority.

31.3. If you use the Services for business or professional purposes, the parties will first attempt the good-faith resolution in Section 31.1; unresolved disputes are decided by the competent courts under the applicable conflict-of-laws rules.

32. Contact

Questions about these Terms, data-protection requests and formal notices: [email protected].

Annex I: Data Processing Addendum

This Annex applies automatically whenever Rocksosint processes personal data as processor on your behalf (Section 18.3). It is intended to meet the requirements for controller–processor arrangements under Article 28 of the EU and UK GDPR and similar laws.

1. Roles

You are the controller and Rocksosint is the processor for the personal data described below, to the extent we process it on your documented instructions. Processing for our own purposes (Section 18.4) is outside this Annex.

2. Instructions

We process personal data only on your documented instructions (the Order, your authorized use of the Services and written instructions we accept), unless the law requires otherwise, in which case we tell you first where legally allowed. We will tell you if an instruction appears to infringe data-protection law and may pause the affected processing.

3. Confidentiality and security

People authorized to process personal data are bound by confidentiality and get access only as needed. We maintain appropriate technical and organizational measures, including access controls and per-account isolation, authentication and session management, encryption in transit and at rest, log redaction, rate limiting, vulnerability management and recovery controls, as described in the Privacy Policy.

4. Subprocessors

You give general authorization for the subprocessors needed to provide the Services, listed in the Privacy Policy. We give reasonable notice of a new or replaced material subprocessor by updating that list. You may object on reasonable data-protection grounds; if no reasonable alternative exists, either party may end the affected Service. We impose equivalent written data-protection obligations on each subprocessor.

5. Assistance, incidents and deletion

We help you, as reasonably possible, respond to data-subject requests, meet security and impact-assessment obligations, and notify security incidents: we tell you without undue delay after becoming aware of an incident affecting personal data processed under this Annex, with the information reasonably available to us. Query data is processed transiently and not kept in your Account except where you save Outputs, request an AI-generated analysis or a late result is being delivered, for the periods in the Privacy Policy. When your Account closes, we delete personal data processed under this Annex unless the law requires retention.

6. Audits and transfers

We make available the information reasonably needed to show compliance. You may audit, or appoint a confidential independent auditor, no more than once every 12 months with reasonable notice, unless a regulator requires otherwise or after a material incident. International transfers happen only under a valid transfer mechanism, such as an adequacy decision, standard contractual clauses or the EU-U.S. Data Privacy Framework.

7. Processing details