Terms of use
Draft reviewed 19 October 2026
1. What the service does
Mapped Steps helps you organise process steps, create workflow diagrams and prepare procedure drafts. Available features depend on the service configuration. The private preview is still being tested; features may change and errors or interruptions can occur. Availability, recovery and support commitments must be agreed before a customer relies on them.
Each person uses their own account. Workspace members share the workspace’s documents, saved history and submitted steps. Owners and admins control permitted membership; editors may change content and viewers may read and export it. There are no per-document access restrictions within a workspace. Invite only authorised people, choose the minimum permission they need and review access when responsibilities change.
2. Your account and authority
Use your own account and protect your sign-in access. Tell the operator promptly if you suspect unauthorised use. If you act for an organisation, you must have authority to use the service, supply its content and agree the applicable contract on its behalf.
You are responsible for the instructions you give and the accuracy of the information you submit. This does not make you responsible for failures caused by the operator or excuse the operator’s own contractual or legal duties.
3. Keep inputs necessary and lawful
Only add material you are entitled to use and share. Provide any notices, permissions and lawful basis needed for information about colleagues, customers or other people. Use job roles instead of personal names where practical and include only what the workflow needs.
The proposed standard service is for ordinary business process information. Do not enter passwords, access keys, payment-card details, identity documents, health information, other special-category personal data, criminal-offence information or information about children. A different sensitive-data use would require a separate assessment and written agreement before use; this draft does not authorise it.
Do not upload unlawful material, infringe another person’s rights, interfere with the service, bypass access controls or use it for harmful or deceptive activity.
4. Contribution links and exports
A contribution link lets a person with that link submit steps without an account. Share links only with intended contributors, provide the context they need and revoke links when finished. Review submissions before placing them in your workflow. A link does not verify a contributor’s identity or give the contributor access to the master workflow.
You decide who receives your exported files and how they are stored or used after delivery. Verify the destination and remove unnecessary personal information before sending. Keep suitable independent copies for your needs. These responsibilities do not waive any applicable duty of the operator to protect content, provide agreed recovery measures or remedy its own failure.
5. Your content and confidentiality
You retain your rights in the content you supply. You grant the operator a limited, non-exclusive permission to host, process, reproduce and transmit that content only as needed to provide, secure and support the service and carry out your instructions, including requested exports or AI drafting. This permission extends to service providers only for those purposes and subject to appropriate contractual protections.
This permission does not grant a right to sell or publicly publish your content, use it for advertising, or use it to train the operator’s own AI models. The processing terms of an external AI provider must be assessed separately; no claim about that provider’s training or retention practices is made by this draft.
The operator must protect non-public customer content and use it only for the agreed service purposes. Access and disclosures must be limited to authorised people and providers who need them, your instructions, or legal requirements. Where lawful, the operator must tell you about a legally compelled disclosure. The data processing agreement governs personal data processed on your behalf.
6. AI drafts need review
AI drafting is optional. An AI-generated SOP or policy may omit steps, invent details or give incorrect information. It is a draft for review, not legal, regulatory, safety or other professional advice, and it does not certify compliance.
Before using or sharing a draft, a suitably qualified person must check its facts, sequence, responsibilities, controls and suitability for your organisation and applicable requirements. You decide whether to approve or implement it. Do not use generated content as the sole basis for decisions that significantly affect people or safety. These requirements do not exclude the operator’s responsibility for promises it makes or duties the law imposes.
7. Service care, changes and ending use
The operator must exercise the care and skill required by applicable law and meet the commitments in a final agreed contract. No draft clause promises an uninterrupted or error-free service. A final agreement must explain material changes, support, export access, termination and deletion. This draft does not establish a paid plan, billing arrangement, cancellation charge or right to retain data indefinitely.
Access may need to be restricted to address a genuine security risk, unlawful use or a material contract breach. Any final restriction process must be proportionate, give notice and a chance to resolve the issue where appropriate, and preserve rights and remedies required by law.
8. Proposed allocation of business risk
For a business customer, the intended approach is responsibility for direct, reasonably foreseeable loss caused by a breach, with exclusions for indirect or consequential loss and for loss of profit, revenue, anticipated savings, business opportunity or goodwill only to the extent such exclusions are lawful and reasonable. This is a proposed allocation for legal review, not a statement that any particular loss is automatically excluded.
No numerical liability cap is currently agreed or applied by this draft. The amount, any minimum protection for free use, any separate treatment of confidentiality or personal-data claims, and appropriate insurance must be assessed against the final service, price and risk. A reference to a future cap does not itself create one.
Nothing here excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited. Nothing restricts mandatory consumer rights, the rights and remedies of individuals under data protection law, regulator powers, or each party’s direct statutory obligations. Any final business limitation must be fair and reasonable where the law requires it and must not apply to a consumer contrary to their rights.
This draft does not require you to indemnify the operator for all claims or for the operator’s own wrongdoing. It does not transfer responsibility for the operator’s appointed subprocessors away from the operator where data protection law requires that responsibility.
9. Contract details still to agree
The legal operator and contact, contract acceptance process, service commitments, commercial model, lawful liability limits, insurance, governing law and dispute forum remain open. No country’s law or courts are selected by this draft. Any final dispute provision must preserve mandatory consumer and data protection protections.
Material terms should be provided before acceptance, with a dated version kept as evidence. Privacy information explains data use; reading it is not blanket consent to every processing activity. Optional marketing consent must remain separate.
Review sources
UK references for the conditional legal review: Unfair Contract Terms Act, section 2, section 11, Consumer Rights Act, section 62 and section 65. Local legal review is required once the operator and markets are known. This page is not a legal certification.