Terms of service

These terms are a contract between Tomorrow Labs ("we", "us"), the operator of AdHub, and the agency that registers a workspace ("you", "the Agency"). They apply when you create an account, use the console or the client portal, or use the free tools. The person accepting them confirms they are authorised to bind the Agency.

Schedule 1 (Operator terms) and our privacy policy form part of this agreement. Accepting these terms accepts Schedule 1 with them. If you do not accept these terms, do not use the service.

AdHub is a console for managing advertising work: campaign records, client briefs, creative versions and approvals, budget monitoring, tracking links, scheduled reporting and integrations with advertising platforms and work trackers.

AdHub is a management layer. It is not an advertising agency, a media buyer, an advertising platform, or a provider of legal, financial or marketing advice. Decisions about what to advertise, to whom, and at what budget are yours.

Registration is a request, not a right. We review every request and may decline one without giving reasons beyond those we choose to give. On approval you receive a tenant workspace. Your data is logically separated from every other tenant's; we do not use one agency's client data to serve another agency, and we do not sell it.

• You must give accurate account details and keep them current.
• You are responsible for who you invite into your workspace and for everything done under your users' credentials. Keep credentials confidential, and tell us promptly if you suspect one has been compromised. We strongly recommend two-factor authentication.
• Accounts are per person. Sharing one login between several people defeats the audit record and is not permitted.
• Roles decide what a user may change. Giving someone an owner or admin role is your decision, and we act on the permissions you configure.
• Users must be at least 18 and able to enter into a binding contract.

You agree not to use AdHub to:

• break any law, or run advertising that breaks the rules of the platform it runs on
• upload content you do not have the rights to, including creative assets, fonts, imagery and music
• send unsolicited bulk messages
• upload malware, or attempt to gain access to another account, agency or client's data
• probe, scan, overload, attack or interfere with the service, its infrastructure or any platform it connects to
• scrape or systematically extract data from the service other than through features we provide, or build a competing product from our interfaces
• resell or white-label the service without a written agreement with us
• load special personal information into free-text fields (see the privacy policy)

Automated access to our API is fine within the rate limits and scopes we publish. Circumventing them is not.

You own everything you put into AdHub: briefs, creative files, client records, reports and campaign data. We claim no ownership of it.

You grant us a limited licence to host, copy, transmit, display and process that content strictly to provide the service to you. That licence exists for no other purpose and ends when the content is deleted. Where the content includes personal information about your clients or their customers, we process it as your operator under Schedule 1.

You confirm you have the right to upload what you upload, including any personal information, and that you have whatever consent or lawful basis that requires.

We do not use your content to train machine-learning models. Where you use the optional AI features, the text you submit is sent to our AI provider to produce that specific result and for no other purpose.

Connecting an advertising platform, work tracker, storage provider or analytics property authorises AdHub to act on your behalf within the permissions you granted, using credentials you supply through the provider's own authorisation flow. You remain bound by each provider's own terms, and their terms govern their service, not ours.

You pay the advertising platforms directly. AdHub never holds your media budget, never bills you for ad spend, and is not a party to your account with Meta, Google or any other platform. Your subscription to AdHub is separate from and additional to what you spend on advertising.

Platforms change their APIs, revoke access, deprecate endpoints and reject applications on their own schedule. Where that breaks or removes a feature we will say so plainly, but we cannot commit to a platform's continued availability. Disconnecting an integration deletes its stored tokens and stops the flow immediately.

AdHub can watch campaign spend and pause campaigns automatically when they breach a threshold you set. It is a safety net, not a spending cap:

• Checks run on a schedule, not continuously. Spend can occur between one check and the next.
• We act on the figures the platform reports. Platforms report spend with a lag, restate it after the fact, and occasionally return nothing at all.
• A pause instruction we send can be rejected, delayed or overridden by the platform, or reversed by anyone with access to the platform's own interface.
• An expired connection, a revoked permission or a platform outage stops the monitoring. We show that state in the console, and it is your responsibility to act on it.

You remain responsible for money spent through your accounts. To the extent the law allows, we are not liable for spend that occurs despite a rule, threshold or automation configured in AdHub.

Performance figures in AdHub originate with the advertising platforms and analytics properties you connect. We label every figure with where it came from and, where two sources disagree, which one was used. We do not restate or adjust a platform's numbers, and we cannot warrant their accuracy.

Competitive reports are observations of publicly available advertising (what is running, for how long, and where it points) together with data you import or enter yourself, within a stated sample. They are not an audit of a competitor, they do not include any competitor's spend, revenue or results, and they are not marketing, financial or legal advice. Each report states the sample it was drawn from; read it before acting on a percentage.

The tools at /tools are free and need no account. They are offered as-is, we make no commitment to keep any of them available, and we may change or withdraw them at any time. Without an account, what you enter stays in your browser; clearing your browser data clears it, and we cannot recover it. Those pages may carry third-party advertising. The console does not.

• Plan tiers, their limits and their prices are as published in the application. Where a plan is complimentary or custom, the terms of that arrangement are as recorded on the workspace.
• Paid plans are billed in advance, per billing period, at the price shown when you subscribe. Payment is handled by our payment processor; we do not store your card details.
• Plan limits (clients, storage, integrations) are enforced by the service. Exceeding a limit does not incur an automatic charge; the feature stops until you upgrade or free up room.
• Fees are exclusive of VAT and any other applicable tax, which is added where required.
• You can cancel at any time from your billing settings. Cancellation takes effect at the end of the current billing period, and the account stays on its paid plan until then.
• Fees already paid are not refundable except where the law requires it, or where we have failed to provide the service and cannot put it right.
• We may change prices with at least 30 days' notice by email to account owners. A price change takes effect at your next renewal, and you can cancel before it applies.
• If a payment fails we will retry and notify you. Persistent non-payment may lead to suspension under clause 17.

The AdHub software, interface, documentation, name and branding belong to Tomorrow Labs. These terms grant you a limited, non-exclusive, non-transferable right to use the service while your account is in good standing, and nothing more. You may not copy, decompile, reverse-engineer or create derivative works from it, except where the law expressly permits it despite this clause.

If you send us feedback or a feature request, we may use it without obligation or payment. You keep every right in your own content (clause 6).

We will provide the service with reasonable skill and care and aim to fix what breaks, but this agreement carries no uptime commitment unless we have signed a separate written service-level agreement with you. We may take the service down for maintenance, and will give notice where a planned window is likely to be disruptive. Support is by email to the legal contact address shown on /tos and /contact, during South African business hours.

To the fullest extent the law allows, AdHub is provided as is and we exclude all implied warranties: merchantability, fitness for a particular purpose, non-infringement, and any warranty that the service will be uninterrupted, error-free or produce any particular commercial result.

Nothing in these terms excludes or limits any right you have under the Consumer Protection Act 68 of 2008 or other law that cannot lawfully be excluded, and nothing here limits liability for death, personal injury, fraud or wilful misconduct.

Subject to clause 14, neither party is liable to the other for indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated savings, loss of business or loss of goodwill, however arising.

Our total aggregate liability arising out of or in connection with this agreement, whether in contract, delict or otherwise, is limited to the fees you paid us for the service in the twelve months before the event giving rise to the claim. Where you pay us nothing (the free tier and the free tools) that limit is zero, and we say so here rather than leaving you to work it out.

Advertising spend paid to a platform is not a fee paid to us and does not count toward that cap.

You will indemnify us against claims, losses and reasonable legal costs arising from your content, your advertising, your use of the service in breach of these terms, or your breach of a connected platform's terms. We will tell you promptly of any such claim and will not settle it without your consent.

You may close your account at any time. We may suspend or terminate an account on notice if you materially breach these terms and do not fix it within 14 days of being told, or immediately where the breach cannot be fixed (unlawful use, an attack on the service, a security risk, a legal requirement, or persistent non-payment after notice).

On termination your right to use the service ends. You can export your data at any time while the account is active and for 90 days after it closes, so an account closed in error is not a disaster. After those 90 days we delete it, except records we must keep by law, which follow the retention periods in the privacy policy. Clauses on intellectual property, liability, indemnity and governing law survive termination.

We may update these terms. The version and effective date at the top change with them. For a material change we will email account owners at least 30 days beforehand. If you do not accept a change, cancel before the effective date and we will refund the unused portion of your current period.

Each acceptance is recorded against your workspace with the version, a fingerprint of the exact text, the person who accepted and a timestamp. When the version changes, an owner or admin must accept the new version before your team can carry on working in the workspace. Your clients' access to their portal is not interrupted while that is pending.

• This agreement is governed by the law of the Republic of South Africa, and the parties submit to the exclusive jurisdiction of the courts of the Republic of South Africa.
• These terms (with Schedule 1) and the privacy policy are the entire agreement between us and replace any earlier understanding, except where we have signed a separate written agreement with you, which prevails to the extent of any conflict.
• If a clause is found unenforceable, the rest stands and that clause is read down to the minimum extent needed to make it enforceable.
• Not enforcing a term on one occasion does not waive it.
• You may not assign this agreement without our written consent. We may assign it as part of a merger, acquisition or sale of the business, on notice to you.
• Neither party is liable for failure to perform caused by events genuinely beyond its reasonable control.
• Notices to us go to the legal contact address shown on /tos and /contact. Notices to you go to the email address on the owner's account.

PLACEHOLDER — counsel to supply the wording of this whole schedule. The headings record what a written operator agreement under POPIA s21, and a processor agreement under GDPR Art 28(3), has to cover. The "To cover" notes under each heading are engineering notes on what the product does today, not contract wording.

This schedule applies to personal information you load into AdHub about your own clients and their customers. For that information you are the responsible party (the controller) and we are your operator (the processor).

S1.1 Subject matter, duration, nature and purpose [Placeholder: counsel to supply wording]

To cover: running the AdHub service for the Agency for the life of the agreement; the categories of data (client contact details, brief content, campaign records, creative files) and of data subjects (the Agency's clients, their staff and their customers).

S1.2 Written contract (POPIA s21) [Placeholder: counsel to supply wording]

To cover: a statement that this schedule is the written contract s21(1) requires between the Agency as responsible party and us as operator, accepted with these terms and recorded with its version.

S1.3 Security measures (POPIA s19) [Placeholder: counsel to supply wording]

To cover: the appropriate, reasonable technical and organisational measures we establish and maintain, including tenant separation, encryption of stored platform credentials, access by role and an audit record of changes.

S1.4 Confidentiality and acting on instructions (POPIA s20) [Placeholder: counsel to supply wording]

To cover: we process the information only with the Agency's knowledge or authorisation, and treat it as confidential, not disclosing it unless the law requires it or our duties require it.

S1.5 Notifying the Agency of a compromise (POPIA s21(2)) [Placeholder: counsel to supply wording]

To cover: we notify the Agency immediately where there are reasonable grounds to believe its clients' personal information has been accessed or acquired by an unauthorised person, so the Agency can meet its own s22 duty.

S1.6 GDPR Art 28(3)(a): documented instructions [Placeholder: counsel to supply wording]

To cover: processing only on the Agency's documented instructions, including for transfers outside the EEA or UK, unless the law requires otherwise, in which case we tell the Agency first unless the law forbids it.

S1.7 GDPR Art 28(3)(b): confidentiality of personnel [Placeholder: counsel to supply wording]

To cover: everyone authorised to process the data is under a duty of confidentiality.

S1.8 GDPR Art 28(3)(c): security of processing (Art 32) [Placeholder: counsel to supply wording]

To cover: the measures in S1.3, stated against Art 32.

S1.9 GDPR Art 28(3)(d): engaging sub-processors [Placeholder: counsel to supply wording]

To cover: the conditions in S1.14 for engaging another processor, and that each sub-processor is bound by the same data protection obligations.

S1.10 GDPR Art 28(3)(e): helping with data-subject requests [Placeholder: counsel to supply wording]

To cover: helping the Agency answer requests to access, correct or delete personal information, as far as the service makes that possible.

S1.11 GDPR Art 28(3)(f): helping with security, breaches and impact assessments (Arts 32 to 36) [Placeholder: counsel to supply wording]

To cover: helping the Agency meet its duties on security, breach notification to the regulator and to data subjects, data protection impact assessments and prior consultation.

S1.12 GDPR Art 28(3)(g): deletion or return at the end [Placeholder: counsel to supply wording]

To cover: at the Agency's choice, return or deletion of the personal information at the end of the service, as set out in S1.16.

S1.13 GDPR Art 28(3)(h): audits, information and unlawful instructions [Placeholder: counsel to supply wording]

To cover: making available the information needed to show compliance, allowing for and contributing to audits, and telling the Agency immediately if an instruction appears to breach data protection law.

S1.14 Sub-processors [Placeholder: counsel to supply wording]

To cover: the Agency gives a general authorisation for the sub-processors we list at /subprocessors. We tell account owners of any planned addition or replacement before it takes effect, and the Agency may object within a notice period [Placeholder: counsel to set the period]. If an objection cannot be resolved, the Agency may terminate the affected part of the service.

Recipients: the sub-processors every account uses, with what each does and where it processes data, are listed at /subprocessors. The optional recipients that only the Agency's own choices bring in (connected advertising platforms, work trackers, storage and analytics, chat alerts to Slack, Teams or a WhatsApp bridge, and Anthropic and Meta's MCP server once Meta MCP is turned on) are listed in the privacy policy at /privacy-policy#recipients.

S1.15 Cross-border transfers (POPIA s72) [Placeholder: counsel to supply wording]

To cover: some sub-processors process information outside South Africa. Each transfer relies on a s72 ground, such as the recipient being bound by law, binding corporate rules or an agreement giving an adequate level of protection.

S1.16 Return or deletion at the end [Placeholder: counsel to supply wording]

To cover: the Agency can export its data while the account is active and for 90 days after it closes (clause 17). After that window we delete it, except where the law requires us to keep it, and confirm the deletion on request.