Terms of Service

1. About these terms

These terms are an agreement between you and Aivolux Technologies, a [type of business — e.g. Sdn Bhd, or sole proprietorship/enterprise registered with SSM] registered in Malaysia under registration number [SSM registration number] with its registered address at [registered address in Malaysia], trading as BuildMetrics (“we”, “us”). We offer BuildMetrics to engineers worldwide. They cover your use of the BuildMetrics website and application (the “service”). By creating an account or using the service you agree to them. If you accept them for an organisation, you confirm you have authority to bind it, and “you” includes that organisation.

Our Privacy Policy explains how we handle personal data and forms part of these terms.

2. The service

BuildMetrics provides calculators for structural, civil and geotechnical design to the Eurocodes — with a National Annex or design basis chosen for each project, such as the UK National Annex or the Eurocode recommended values, and others as we add them — a report builder, a controlled workflow to draft, check, approve and issue reports, a document register with verifiable issue hashes, and — on BuildMetrics Advanced — Metric, an AI assistant, with its Knowledge Centre and Drive mode. We may improve, change or withdraw features; we will give reasonable notice of any change that materially reduces what you have paid for.

3. Calculations and engineering responsibility

4. Who may use BuildMetrics

BuildMetrics is for professional and educational use by people aged 18 or over who are qualified engineers, or graduates and students working under the supervision of one. You must not present output from the service as a professional calculation without independent verification and sign-off by a suitably qualified engineer.

5. Accounts and security

You must:

• give accurate details, and use an email address you control — we ask you to confirm it before you can join teams, check or approve;
• use a strong password you do not use anywhere else, keep it to yourself, and never share an account: each person needs their own, because sign-offs are recorded against the person signed in;
• keep the devices you sign in on secure, and sign out of shared computers (Profile & security has “Sign out on every device”);
• tell us at once at security@buildmetrics.uk if you think your account has been used without your permission.

You are responsible for what is done through your account until you tell us it has been compromised. We may require you to reset your password, or suspend access, if we believe an account is at risk.

6. Organisations, teams and roles

Work in BuildMetrics belongs to an organisation — a firm, or a sole practitioner’s own workspace. Its owners and admins decide who belongs to it and who is on each project, and are responsible for keeping that up to date: in particular, removing people promptly when they leave. Nobody is added to an organisation, or to a project from outside it, without accepting an invitation.

Self-checking is offered only where BS EN 1990 Annex B allows it (consequence class CC1, design supervision level DSL1) and only while nobody independent can check; the issued document says so. Choosing the right consequence class for a project is the engineer’s responsibility.

7. Acceptable use

You must not, and must not help anyone else to:

• break any law that applies to you or to us — including computer misuse laws (such as Malaysia’s Computer Crimes Act 1997 and the UK’s Computer Misuse Act 1990) and data protection laws (such as the PDPA, the UK GDPR and the EU GDPR) — or professional rules that apply to you;
• access, or try to access, accounts, organisations, projects or data you have not been given access to, or get round any access control, rate limit or usage allowance;
• probe, scan or test the service for vulnerabilities, except as section 8 allows;
• upload malware or content designed to run in other people’s browsers, or interfere with or overload the service;
• scrape or bulk-download the service by automated means, or reverse-engineer it except as the law allows;
• use BuildMetrics to send unsolicited or misleading messages — invitations and transmittals are for genuine project contacts — or impersonate anyone;
• resell or provide the service to others without our written agreement.

8. Security testing and reporting vulnerabilities

We welcome reports of security weaknesses. If you find one, email security@buildmetrics.uk with enough detail for us to reproduce it, and give us a reasonable time to fix it before telling anyone else. We will acknowledge your report, keep you informed, and not take legal action against good-faith research that:

1. uses only accounts and organisations you own, and never accesses, changes or deletes other people’s data (if you come across any, stop and tell us);
2. does not degrade the service for others — no denial-of-service, spam, or automated scanning at volume;
3. does not use social engineering or physical attacks against our staff or users.

Any other testing needs our written permission first. Our contact details are also published at /.well-known/security.txt.

9. Your data

Your organisation owns its content: projects, reports, calculation inputs and results, issued documents, review records and Knowledge Centre answers. You give us the licence we need to host, process, back up and display that content in order to provide the service, and for no other purpose. We do not sell it, use it for advertising, or use it to train AI models.

An organisation’s owners can export its documents at any time: issued revisions download as PDF and Word, and we will provide a full export of an organisation’s content on request. Each person can download their own account data and delete their account under Profile & security. Issued revisions and review records stay with the organisation when an individual leaves, because they are its engineering record.

10. Data processing terms

For personal data in an organisation’s content, the organisation is the controller and we are its processor. This section is the contract between us that Article 28 of the UK GDPR and of the EU GDPR requires where those laws apply, and sets out how we meet the obligations Malaysia’s Personal Data Protection Act 2010, as amended (the “PDPA”), places on us as a data processor.

1. Subject and duration. We process the organisation’s content to provide the service, for as long as the organisation uses it, and then as section 18 describes.
2. Nature and purpose. Hosting, storage, backup, display, calculation, document generation, email delivery and, where the organisation uses them, Metric and the Knowledge Centre.
3. Data and people. Names, email addresses, professional designations and work records of the organisation’s staff, collaborators and clients, and any personal data they include in project content.
4. Instructions. We process it only on the organisation’s documented instructions — which these terms and the organisation’s use of the service are — unless the law requires otherwise, in which case we will tell the organisation first unless the law forbids it.
5. Confidentiality. Everyone we authorise to process it is bound to confidentiality.
6. Security. We keep the measures described in section 11 and our Privacy Policy, appropriate to the risk (the PDPA Security Principle and Article 32 of the UK and EU GDPR).
7. Sub-processors. The organisation authorises the sub-processors listed in our Privacy Policy. We give its owners at least 30 days’ notice by email before adding or replacing one, during which the organisation may object; if we cannot resolve a reasonable objection, it may close its account and receive a pro-rata refund of prepaid fees. Each sub-processor is bound by data-protection terms no less protective than these, and we remain responsible for them.
8. Assistance. We help the organisation respond to requests from individuals exercising their rights, and with security, breach notification, data protection impact assessments and consultation with supervisory authorities (such as Malaysia’s Personal Data Protection Commissioner, the UK Information Commissioner’s Office or an EU supervisory authority), as far as the nature of the processing allows.
9. Breaches. We tell the organisation without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its content, with the information we have and as more becomes available.
10. End of processing. When the organisation closes its account we delete its content as section 18 describes, unless the law requires us to keep it, and on request return it first.
11. Information and audit. We make available the information needed to show we meet these obligations, and allow reasonable audits — normally answered by written questionnaire, at most once a year unless a breach or a regulator requires otherwise.
12. International transfers. Transfers of personal data to other countries, including out of Malaysia, the UK or the EU, are protected as our Privacy Policy describes. On request we will sign the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum with an organisation that needs them for transfers to us.

11. Our security commitments

We protect the service with measures including encryption in transit (HTTPS with HSTS), hashed passwords and session tokens, sessions that expire, limits on sign-in attempts, email verification, role-based access checked on our servers for every request, separation of duties in the review workflow, a tamper-evident audit log, issued documents that cannot be edited and can be verified by hash, restrictive browser security policies, rolling backups, and a security test before major releases. We keep these under review and may change them, but will not reduce the overall level of protection.

If a security incident affects your data, we will tell you as section 10 and our Privacy Policy describe, and tell you what we are doing about it.

12. Metric, the Knowledge Centre and Drive mode

Metric is an AI assistant. It drafts narrative text, suggests changes and answers questions using your organisation’s records, but it can be wrong. Anything it drafts is marked unreviewed and cannot be submitted for checking until an engineer has reviewed it; it never enters calculation inputs or results, and never submits, checks, approves or issues a report.

The Knowledge Centre holds answers your organisation has verified, which Metric gives without consulting the AI model. Verifying an answer is your organisation’s engineering judgement: the owner or admin who verifies it is responsible for it, and we do not check its content. The BuildMetrics help answers are general guidance about the service.

You remain responsible for every word and figure in a report you author, check or approve. Metric and Drive mode are subject to the monthly allowances shown in the app. Use Drive mode only hands-free, with your device secured, and only where it is safe and lawful; never interact with the screen while driving.

13. Plans and payment

Basic is free: every calculator, the full draft, check, approve and issue workflow, your letterhead, and free checker, approver and viewer seats. Advanced is a paid subscription held by an organisation that adds Metric and its Knowledge Centre, Drive mode, every automation, unlimited templates and priority support. Current prices are shown at buildmetrics.uk/pricing and in the app.

Advanced is charged per editing seat (a person who writes reports), in advance, monthly or yearly. Prices are in US dollars and exclude taxes: where the law requires, we add VAT, GST, SST or sales tax at checkout, at the rate for where you or your organisation is based. Payment is taken and processed by Stripe; your bank may charge you for currency conversion. A subscription renews automatically until cancelled. An owner or admin can change seats or cancel at any time under Organisation → Plan & billing; cancelling takes effect at the end of the period already paid for. Except where the law says otherwise, we do not refund part-periods. We give at least 30 days’ notice of a price change, effective from your next renewal. If a payment fails or a subscription ends, the organisation returns to Basic and keeps all its work; only Advanced features pause.

14. Availability, backups and your copies

We aim to keep BuildMetrics available at all times, but do not guarantee it will be uninterrupted or error-free; we may need to take it offline for maintenance, usually announced in advance. We keep rolling backups to recover from failures. Issued documents are your firm’s record: keep your own copies (PDF or Word) of anything you issue, as your professional obligations require.

15. Intellectual property

We own the service — its software, calculation engines, design, documentation and help content. You may use it for your organisation’s work under these terms; you may not copy, modify or distribute it, or build a competing product from it. Your content remains yours (section 9). If you send us feedback, we may use it without obligation.

16. Third-party services

The service relies on providers named in our Privacy Policy — including Stripe for payments, Anthropic for Metric’s AI model, Resend for email and Google for optional sign-in — and on your browser’s own speech service for Drive mode. Where you use a third-party service directly (for example Stripe’s checkout or Google sign-in), its own terms also apply.

17. Liability

• Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow to be limited.
• We are not liable for loss of profit, revenue, business, contracts or goodwill, or for any indirect or consequential loss — including loss arising from reliance on a calculation that was not independently verified as section 3 requires.
• Otherwise, our total liability to you in any 12 months for all claims under or in connection with these terms is limited to the greater of US$100 and the fees you paid us in those 12 months.
• If you use BuildMetrics as a consumer, you keep the mandatory rights that the consumer protection law of the country where you live gives you (for example, in the UK, under the Consumer Rights Act 2015), and nothing in these terms limits or excludes them.

You will compensate us for losses arising from a breach by you of section 7 or from a third-party claim caused by content you put into the service, except to the extent we caused them.

18. Suspension and ending

You can stop using BuildMetrics at any time. Each person can delete their own account under Profile & security. An organisation’s owner can ask us to close the organisation; we delete its content 90 days after closure, having given its owners the chance to export it, except where the law requires us to keep something.

We may suspend access immediately where needed to protect the service, its users or their data — for example a compromised account, an attack, or a serious breach of section 7 — and will tell you why and restore access once the risk has passed. We may end these terms for a material breach you have not put right within 14 days of our notice, or on 60 days’ notice for any reason, in which case we refund any prepaid fees for the unused period. Sections 3, 9, 10, 15 and 17 survive the end of these terms.

19. Changes to these terms

We may update these terms. For a material change we email account holders at least 30 days before it takes effect; if you do not agree, you may stop using the service and close your account before then, and we refund any prepaid fees for the unused period. We may make changes required by law, or that only help you, sooner.

20. General

• Law and courts. These terms, and any dispute about them (including non-contractual disputes), are governed by the laws of [Malaysia / England and Wales], and the courts of [Malaysia / England and Wales] have exclusive jurisdiction. If you are a consumer, this choice of law does not take away the protection of the mandatory laws of the country where you live, and you may also bring proceedings in the courts of that country.
• Events beyond our control. We are not responsible for delay or failure caused by events we could not reasonably have prevented.
• Transfer. You may not transfer these terms without our written consent. We may transfer them to a successor to our business, who will be bound by them.
• Severability and waiver. If part of these terms is unenforceable, the rest continues. Not enforcing a term straight away does not waive it.
• Entire agreement. These terms and the Privacy Policy are the whole agreement about the service and replace earlier versions.
• Third parties. Only you and we have rights under these terms, and nobody else may enforce them (where English law applies, the Contracts (Rights of Third Parties) Act 1999 is excluded).

21. Contact