1.Purpose
These terms and conditions of sale govern the subscription to and use of the Tocsin24 service, published by Crazylink (see the legal notice). Tocsin24 is an online service for monitoring the security, availability and activity of Magento 2 and WordPress sites. It is intended for business customers only. Any subscription constitutes acceptance of the terms in force on that date.
2.Account and access
Access to the service requires an account, protected by a password and mandatory two-factor authentication. The customer keeps their login details confidential and is responsible for their use. The customer undertakes to monitor only sites that they operate or for which they have the permission of the site operator, in particular when an agency equips its own clients’ sites. Installing the Magento module or the WordPress plugin, and any SFTP access to log files, remain the customer’s responsibility.
The account holder is the contracting customer: they alone manage billing and the people who can access their sites in Tocsin24. They are responsible for the people they invite and the access they grant. They may grant a service provider, including Crazylink, contributor access: limited in time (30 days at most), recorded in the account log and revocable at any time. For support purposes, Crazylink may log in to the interface on behalf of a user, for 60 minutes at most; these logins appear in the account log.
A monitored site remains attached to the account that created it. Only Crazylink can attach it to another account, at the written request of both account holders.
3.Subscriptions and prices
The subscription is taken out per monitored site:
- Magento 2: €49 excl. VAT per month, or €490 excl. VAT per year;
- WordPress / WooCommerce: €19 excl. VAT per month, or €190 excl. VAT per year.
A staging site is billed at half price, without SMS. Each Magento site includes 50 SMS credits per month and each WordPress site 20 SMS credits per month; these credits are monthly whatever the plan and cannot be carried over. One credit corresponds to one alert SMS to France; to another country, an SMS uses the number of credits shown for that country on the Pricing page. SMS alerts are only sent to the European Union, the United Kingdom, Switzerland and Norway. Add-ons: AI analysis at €9 excl. VAT per month or €90 excl. VAT per year, per site; a pack of 100 extra SMS credits at €10 excl. VAT, with no expiry date.
Prices are exclusive of tax; the applicable VAT is added. A site added during a billing period is charged pro rata. Crazylink may change its prices by giving the customer at least 30 days’ notice; the new price applies from the following period, and the price of an annual subscription is guaranteed for 12 months.
4.Free trial
Each new account is entitled to a 7-day free trial. A payment card is requested at the end of sign-up. At the end of the 7 days, the subscription starts automatically and the first period is charged, unless the customer has cancelled it from their account during the trial, in which case no payment is taken.
During the trial, monitoring, incidents and alerts are complete. The following are reserved for subscribers: the details of the hardening checks (only their number is shown), the steps to follow for incidents, the patches to apply, exports and AI analysis. The customer may end the trial at any time (“Start my subscription”): the first period is then charged immediately; if the payment is declined, the trial continues.
The trial is granted only once per account and per monitored domain (with or without “www.”): a domain that has already benefited from it, on any account whatsoever, starts its paid subscription immediately upon subscription. To enforce this, Crazylink keeps a non-reversible fingerprint of the domain, with no time limit.
5.Payment and invoicing
Payment is made by card, in advance for each period, through Stripe; Crazylink never has access to the card number. Invoices are available in the customer’s account. Before an annual subscription renews, a reminder email is sent 30 days in advance. If a payment fails, the customer is notified and the payment is retried; if the situation is not remedied, the service may be suspended and then terminated.
6.Termination
The monthly subscription has no minimum term: it can be cancelled at any time from the account and ends at the end of the current month. The customer may also delete a site from their account: monitoring stops immediately, the site is no longer billed from the next due date (the current month remains payable) and its data is erased within 30 days. The annual subscription is payable for the whole year: its cancellation takes effect at the end of the term, with no pro rata refund. The customer may switch from monthly to annual at any time, and from annual to monthly at renewal. Crazylink may suspend or terminate the account in the event of a serious breach of these terms, after a formal notice that has remained without effect, except in an emergency. At the end of the contract, the customer’s data is deleted within 30 days, subject to legal retention obligations (invoices); an email notifies the customer 7 days beforehand.
7.Service availability
Crazylink uses reasonable means to ensure access to the service 24 hours a day, except during maintenance and in cases of force majeure. Tocsin24 reports and explains; it does not block attacks and does not replace a firewall, backups or updates to the site. Detection depends on the data that can be collected from the site and on the delivery of emails, SMS and notifications by the operators; Crazylink does not guarantee that an incident will be detected, nor within any given time.
8.Liability
Crazylink is bound by an obligation of means (best endeavours). It cannot be held liable for indirect damage, in particular loss of revenue, data or reputation. For all causes combined, its liability is limited to the amounts paid by the customer for the service during the 12 months preceding the event giving rise to the claim. The customer remains responsible for the security, maintenance and backups of their sites.
9.Data
For the data in the customer’s account, Crazylink acts as data controller (see the privacy policy). For the personal data contained in the logs that the customer has collected (IP addresses, pages visited), Crazylink acts as processor, on the customer’s instructions, under the conditions of Article 28 of the GDPR, set out in the “Data processing” annex to these terms. The data is hosted in Switzerland.
10.Partner programme
Agencies and freelancers can become resellers (a discount of 15% for 5 to 9 sites, 25% for 10 to 24 sites, 30% from 25 sites, Magento and WordPress combined) or referral partners (20% of the subscriptions they bring in for 12 months, paid quarterly). The terms are set out in specific conditions signed with each partner.
11.Governing law
These terms are governed by French law. In the event of a dispute, the parties will first seek an amicable solution; failing that, the dispute will be brought before the competent courts of Avignon.
12.Annex: data processing
This annex applies when the customer turns on the collection of their sites’ logs. Crazylink acts as the customer’s processor within the meaning of Article 28 of the GDPR.
Subject matter and duration. Crazylink collects, stores and analyses the log lines of the customer’s sites in order to detect incidents and attack attempts, for the entire term of the contract.
Data and data subjects. Access and error log lines: IP addresses, date and time, pages requested, response codes, browser, referring page, error messages. They concern the visitors and users of the customer’s sites.
Crazylink’s obligations. Crazylink:
- processes this data only to provide the service, in accordance with these terms and the settings chosen by the customer;
- restricts access to it to the people who need it, who are bound by confidentiality;
- protects it with appropriate measures: encrypted communications, two-factor authentication, restricted access, encrypted backups, hosting in Switzerland;
- keeps raw lines for 7 days, then only hourly statistics with no IP address beyond 7 days;
- assists the customer in responding to requests to exercise data subjects’ rights and, where applicable, in carrying out a data protection impact assessment;
- notifies the customer of any personal data breach concerning them without undue delay, and no later than 48 hours after becoming aware of it;
- deletes this data within 30 days after the end of the contract;
- makes available to the customer the information needed to demonstrate compliance with these obligations and allows an audit upon reasonable request, with 30 days’ notice, at the customer’s expense.
Sub-processors. Crazylink uses the sub-processors listed in the privacy policy. It informs the customer of any addition or replacement at least 30 days in advance; a customer who objects may cancel their subscription. If the customer uses the AI analysis add-on, the elements of the analysed incident, including log lines and IP addresses, are transferred to Anthropic (United States) under standard contractual clauses, with secrets masked before sending.
Access granted by the customer. The people the customer invites, and the service provider to whom they grant contributor access for the duration of that access, view these logs according to their role; exporting raw lines is not available to viewers.
Customer’s obligations. The customer ensures that they have a legal basis for collecting these logs, informs their visitors in their own privacy policy and has only the files needed for monitoring collected.