Terms of Service

Version 1.0 · Last updated: 10 July 2026

These terms govern your use of PII Shield. If you use PII Shield to process personal information on behalf of an organisation, they apply alongside our Data Processing Addendum, which sets out how we handle that information.

1Who we are

PII Shield is a service operated by Aeryn Quarmby, a sole proprietor trading as PII Shield, in South Africa. In these terms, "we", "us" and "PII Shield" mean that provider, and "you" means the individual or organisation using the service. Contact: [email protected].

2What the service does

PII Shield detects personal information in text and documents and replaces it with placeholder tokens before that text reaches an AI service. It is delivered as several surfaces, which differ in where processing happens:

Browser extension and Claude Code plugin. Detection and redaction run entirely on your device. The personal information itself never reaches our servers.
API gateway and MCP server. Text passes through our servers, is redacted in memory, and is forwarded to the AI provider. We do not persist the original text.
Document redaction. The uploaded file is processed to produce a redacted file. The source file is discarded once the redacted output is returned.
Leak Audit. Records that personal information was detected in an AI conversation. It stores a fixed placeholder, a one way fingerprint, and a copy encrypted in your browser to a public key your workspace generates. We hold no key that decrypts it.

Automated detection is not perfect, and you must not rely on it as if it were. PII Shield uses pattern matching, checksums and heuristics. It will sometimes miss personal information (a false negative) and sometimes flag text that is not personal information (a false positive). Every surface that produces a redacted output offers a review step showing what will be masked and why. You are responsible for reviewing that output before you rely on it, particularly before disclosing a redacted document to a third party, a court, or a regulator. We provide no warranty that every item of personal information will be detected.

3Accounts, workspaces and seats

A workspace is created with a workspace key. Anyone holding that key can act as the workspace owner. Treat it as a password. You are responsible for all activity under your workspace, including activity by seats you invite.
Seat keys attribute usage to an individual. An owner or admin can see which seat produced which exposure in the Leak Audit.
If your workspace enables automatic scanning, seats are scanned on first use of the extension. You are responsible for telling the people you invite that this happens, and for having a lawful basis to do so. We publish an employee notice and a DPIA template to help. Whether you use them is your decision.
You must be at least 18 and able to enter a binding contract. PII Shield is a workplace tool and is not directed to children.

4Acceptable use

You may not use PII Shield to: break any law; process personal information you have no lawful basis to process; attempt to defeat, reverse engineer or circumvent the redaction engine in order to extract personal information from another workspace; probe, scan or overload the service; resell the service without our written agreement; or use it to build a competing product. We may suspend a workspace that is causing harm to the service or to others, and will tell you why.

5Your data

You keep all rights in the content you send through PII Shield. We claim none. What we collect, and what we deliberately do not collect, is described in the Privacy Policy. Where we process personal information on your behalf, the Data Processing Addendum governs, and it prevails over these terms if they conflict on that subject.

We do not train models on your content. We do not sell or share it. Request logs hold counts and types, never values.

6Fees, billing and taxes

Paid plans are billed in advance on the term you select. Usage beyond your plan's included volume is either blocked or drawn from credits you have bought, depending on your settings.
Payments are processed by Lemon Squeezy, acting as Merchant of Record. Lemon Squeezy is the seller of record, handles card data and remits VAT and sales tax. We never see your card number.
Prices are shown exclusive of tax unless stated. Tax is added at checkout based on your location.
Subscriptions renew automatically until cancelled. You can cancel at any time from the billing tab, effective at the end of the current term.
Refunds. If the service does not work as described, tell us within 30 days of the charge and we will refund it. We do not otherwise refund partial terms.

7Trials and pilots

We may offer a free trial or a paid pilot on separately agreed terms. During a trial the service is provided as is, and either of us may end it at any time. Anything we tell you about future features during a pilot is a statement of intent, not a commitment, and you should not buy on the strength of it.

8Availability and support

We aim to keep the service available, but we do not offer a contractual uptime commitment on standard plans. Note that the browser extension and the Claude Code plugin keep redacting on your device even when our servers are unreachable, because detection is local. The gateway and the dashboard do not. Support is by email at [email protected].

9Intellectual property

We own PII Shield, including the detection engine, the dashboard and the documentation. You get a non exclusive, non transferable right to use it while your account is in good standing. The Claude Code plugin, including the copy of the detection engine it needs in order to redact on your machine, is published separately and is governed by the licence in that repository.

10Term, termination and deletion

Either of us may terminate at any time. On termination we stop processing, and you may export your Leak Audit before you go. We delete or irreversibly anonymise your workspace data within 30 days of termination, except where we must keep billing records to comply with tax law. Deletion is described in the DPA, clause 10.

11Disclaimers

To the fullest extent the law allows, the service is provided "as is". We disclaim implied warranties of merchantability, fitness for a particular purpose and non infringement. We do not warrant that redaction will identify every item of personal information, that the service will be uninterrupted, or that it will make you compliant with any law. Compliance is an outcome of your practices; PII Shield is a control that supports them.

12Use at your own risk, and no liability for leaks

You use PII Shield at your own risk. It is one control among the several you should have. It is not insurance, not a guarantee, and not a substitute for reviewing what you send to an AI service.

To the fullest extent the law allows, we are not liable for any disclosure, exposure, loss or leak of personal information arising from or connected with your use of the service. That includes, without limitation:

personal information that the detection engine failed to detect and which therefore reached an AI provider or a third party;
personal information that survived in a redacted document, in metadata, in a revision history, or in any part of a file our extraction did not read;
personal information you or your people chose to send after reviewing the proposed redactions, or by rejecting a proposed redaction, or by disabling a detector, or by using the service with detection switched off;
anything an AI provider, or any other third party you send content to, does with the content once it leaves the service;
loss of the private key your workspace generates in the browser, which makes previously encrypted Leak Audit values permanently unreadable, including by us;
exposure caused by your workspace key or a seat key being shared, lost or committed to a repository;
any regulatory fine, penalty, investigation or enforcement action brought against you, and any claim by a data subject against you.

Detection is probabilistic. Section 2 explains this, and every surface that produces a redacted output shows you what will be masked and why, precisely so that a human decides. The decision to disclose is always yours. If the consequence of a missed item would be serious, do not rely on automated detection alone.

These allocations of risk are a basis of the bargain: the price of PII Shield reflects them, and we would not offer the service on any other footing.

Two honest qualifications. First, no contract can exclude a liability that the law says cannot be excluded, and clause 13 says so. Second, where we act as your operator under POPIA and your processor under the GDPR, we owe you statutory duties that this clause does not displace. What we disclaim is liability for the outcome of your disclosure decisions, not our own obligation to secure what you entrust to us, which is set out in the DPA.

13Limitation of liability

Neither of us is liable for indirect, incidental, special or consequential loss, or for lost profits, revenue, goodwill, or the cost of substitute services, however caused, and whether or not the possibility was known.

Our total aggregate liability arising out of or relating to the service, on any theory including contract, delict, negligence and statute, is limited to the amounts you paid us in the twelve months before the event giving rise to the claim, or USD 300 if you have paid us nothing. This cap applies in the aggregate across all claims, not per claim.

Nothing in these terms limits liability that cannot lawfully be limited, including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for gross negligence or wilful misconduct where the law forbids its exclusion, or under sections of the Consumer Protection Act 68 of 2008 that apply notwithstanding agreement. If a court finds any exclusion in clause 12 unenforceable, the cap in this clause still applies to what remains.

14Indemnity

You will indemnify us against third party claims, and against any fine or penalty, arising from your use of the service in breach of these terms or of applicable data protection law. This includes a claim by a person whose personal information you processed without a lawful basis, and a claim arising from your monitoring of employees through automatic scanning or seat level attribution without the notice and lawful basis that clause 3 requires of you.

15Changes

We may change these terms. If a change is material we will give you at least 30 days' notice by email to the workspace owner, and the new version takes effect at the start of your next term. Continuing to use the service after that date means you accept it. The version number and date at the top of this page always identify the current terms.

16Governing law and disputes

These terms are governed by the law of the Republic of South Africa. The courts of South Africa have exclusive jurisdiction, and you and we each submit to them. Before starting proceedings, please write to [email protected]: most disputes are a misunderstanding, and we would rather fix it.

17General

If a provision is unenforceable, the rest survives. A failure to enforce a term is not a waiver of it. You may not assign these terms without our consent; we may assign them to a successor of the business on notice to you. These terms, the Privacy Policy and the DPA are the entire agreement between us on their subject matter.