Terms of Sale

These Terms of Sale govern the contractual relationship between ShadGramers ("the Provider") and any legal entity or individual acting in a professional capacity ("the Customer") wishing to purchase one or more stacks from the ShadGramers catalogue and/or a service engagement (consulting, development or training).

Placing an order implies unreserved acceptance of these Terms.

ShadGramers operates four divisions:

- Consulting: cybersecurity and software architecture (audit, penetration testing, compliance, fractional CTO). - Development: custom application development (SaaS, mobile, e-commerce, showcase sites, private AI/LLM). - OSS: a catalogue of packaged open-source stacks, installed and/or hosted. - Training: cybersecurity, development and artificial intelligence training.

These Terms apply to all of these services, subject to the specific conditions of each quotation.

The services offered are of two kinds:

- Catalogue products (OSS division): self-hosted stacks (one-off installation on the Customer's infrastructure), managed SaaS (hosting, maintenance, monitoring and backups on ShadGramers infrastructure in the EU, monthly or annual subscription), managed on-premises (remote management of the Customer's own infrastructure, annual fee per server). - Service engagements (Consulting, Development, Training divisions): professional services delivered on a fixed-price basis or at a daily rate, quoted from the scope agreed with the Customer.

Every service is the subject of a quotation drawn up from a request submitted through the website forms (/devis for OSS catalogue stacks, /mission for Consulting, Development or Training engagements) or by direct contact.

The quotation states the scope, the deliverables, the indicative schedule and the price (fixed price or daily rate). It is valid for 30 days from its issue date unless stated otherwise.

The order becomes firm upon receipt of the signed quotation or of a purchase order constituting acceptance, together where applicable with the deposit set out in the Payment article.

Prices shown on the website are indicative and stated in euros excluding tax. Only the signed contractual quotation, including applicable VAT, is binding.

For engagements billed at a daily rate, indicative rates (experienced profile, 5 years' experience, French market) are: Consulting €700 to €1,000/day excl. tax, Development €500 to €750/day excl. tax, Training €900 to €1,200/day excl. tax. These amounts remain indicative — the contractual daily rate is set in the quotation.

Prices may be revised annually, with 30 days' notice for ongoing subscriptions. The Customer may terminate without penalty within that period if the revision is unfavourable.

Payments are made by card (via Stripe Inc., a documented exception — see our sovereignty policy) or by SEPA bank transfer.

For SaaS subscriptions: monthly or annual direct debit on a fixed date. For one-off services, fixed-price engagements and daily-rate engagements: 30% on order, balance on delivery, unless a different schedule is set out in the quotation for long engagements.

Late payment incurs interest at the statutory rate plus 5 percentage points.

Indicative lead times are stated in the quotation. ShadGramers undertakes to meet them save in cases of force majeure or delay attributable to the Customer (late access to infrastructure, late validation of prerequisites or interim deliverables).

For fixed-price or daily-rate engagements, any substantial change of scope (amendment) requires prior written agreement and may lead to a revision of the price and/or the schedule.

Commissioning or delivery is deemed effective upon the Customer's receipt of the deployment report or of the deliverable.

ShadGramers undertakes to deploy the means necessary for the proper performance of the service, in accordance with professional standards and confidentiality. Unless an obligation of result is expressly stated in the quotation, consulting, development and training engagements carry an obligation of means.

The Customer undertakes to provide, within the agreed timeframe, the access, information and approvals required to carry out the engagement. Any delay attributable to the Customer may postpone delivery accordingly, without penalty for ShadGramers.

For custom development engagements, the deliverables specifically created for the Customer (proprietary application code, excluding third-party open-source components) are assigned to the Customer upon receipt of payment in full, on the terms set out in the quotation.

Integrated open-source components (catalogue stacks, third-party libraries) remain subject to their original licences (AGPLv3, MIT, Apache 2.0, GPL v2/v3 depending on the component) and are not assigned.

ShadGramers retains the right to reuse general know-how, methods and generic components developed during an engagement, excluding the Customer's specific and confidential material.

ShadGramers undertakes not to access Customer data without explicit authorisation, limited to maintenance work or to performing the engagement.

A GDPR-compliant Data Processing Agreement is offered to every managed SaaS or managed on-premises Customer, and to any Customer whose engagement involves access to personal data. Operational data remains hosted in the EU (France / Germany).

Information submitted through the /devis and /mission forms (name, email, company, phone, project description) is processed in accordance with the Privacy Policy.

Data hosted on the Customer's behalf is encrypted at rest using an encryption key unique to its account, itself locked twice: by a key derived from its password, and by a service key that ShadGramers retains. This second key allows processes that run in the Customer's absence (scheduled backups, provisioning, webhook delivery) to keep working, and prevents a lost password from causing permanent data loss. Assumed consequence: ShadGramers can technically restore access to this data without knowing the Customer's password; this capability is reserved for the service's automated processes and for the lost-password recovery procedure, detailed in the Privacy Policy.

Availability guarantees (SLA) are set by the SUBSCRIBED PLAN, not by the support tier: - PME plan: 99.5% monthly (< 3 h 40 min downtime/month) - ETI plan: 99.9% monthly (< 1h/month) - Enterprise plan: 99.95% monthly (< 22 min/month)

Bronze, Silver and Gold support tiers set response times and support channels, not the availability guarantee.

In the event of an SLA breach, a service credit is applied pro rata, capped at €5000 per incident.

The Customer may terminate any subscription on 30 days' notice. ShadGramers then provides a full data export within 15 days of effective termination, in an open format (CSV, JSON or SQL dump depending on the service).

No termination penalty applies, regardless of the subscription's age. For fixed-price engagements interrupted at the Customer's initiative, work already performed is invoiced pro rata.

After the export deadline, ShadGramers retains the Customer's data for 90 days from effective termination, then erases it permanently. During that period the Customer may request a further copy of the export. Beyond it, the data is unrecoverable.

ShadGramers' liability is limited to direct damages and to the amount invoiced over the last 12 months (or, for a one-off engagement, to the amount of that engagement). ShadGramers shall not be held liable for indirect damages (loss of revenue, reputational harm, and the like).

These Terms apply exclusively to business customers (legal entities or individuals acting in the course of their professional activity — SMEs, mid-caps, public bodies). The consumer mediation scheme (Articles L.616-1 et seq. of the French Consumer Code) does not apply to business-to-business relationships governed by these Terms.

These Terms are governed by French law. In the event of a dispute, and failing an amicable settlement, the competent commercial courts shall be those of ShadGramers' registered office.

After payment, you have 48 hours to complete the configuration of your space (deployment mode, legal information, subdomain). A reminder email is sent 24 hours after payment if this step is not yet complete, informing you of the time remaining.

If this deadline passes without completion, your order is cancelled and the amount paid is refunded to you in full on the payment method used, with no action required on your part. The refund appears within 5 to 10 business days depending on your bank.

For payment methods with deferred settlement (bank transfer, SEPA direct debit), the 48-hour period runs from the effective confirmation of settlement — not from the order date — and is extended to 72 hours to allow for the delivery time of the configuration email.