Terms of Service

1. Who we are

Promethia (promethia.dev) is operated by Antonio Fernández Porrúa, sole trader (“Promethia”, “we”).
Spanish tax ID (NIF): 71643249C.
Address: Muros del Nalón 7 5N, 33012 Oviedo, Spain.
Contact: support@promethia.dev.

2. The service

Promethia provides technical and documentary compliance assessments for software applications. Each assessment compares requirements applicable to the agreed product and markets with its documentation and an identified source-code version. The private report distinguishes observed support, gaps, possible gaps, insufficient evidence and requirements that are not applicable, explaining the basis for each conclusion. The scope includes privacy, consent, data handling, third parties, retention and data protection rights. Promethia coordinates the review and uses automated analysis; the report identifies its method and limitations.

Subscriptions are purchased per application, billed monthly or annually and renewed automatically until renewal is cancelled. Each subscription month includes one assessment, even if the code has not changed, because laws, sources or configuration may have changed. A delivery can use that month’s included assessment; if it remains available, we automatically assess the latest received ZIP. A ZIP and completed application context are required before assessment can begin. Included assessments do not roll over. Each extra assessment requires separately confirmed payment; prices and billing periods appear in the dashboard and Stripe before purchase.

The owner may issue an invitation limited to an assessment so the team can read and update shared context, check status and access the report. Invitations expire after 14 days and can be revoked or replaced. Every reassessment, including unchanged code, is a new assessment; payment buys assessment work, never a favourable result.

3. Report access and privacy

Requests, source code and reports remain private. The account owner and holders of a valid assessment invitation may access its report; the team can also read the shared context and questions. The account owner must restrict access to authorized people and revoke invitations when no longer needed.

Our public report comes from an actual assessment of Promethia. New assessments focus on technical and documentary compliance and freeze the application context, documents and code version used. Missing operational evidence and unresolved applicability remain explicit in the report. Historical reports retain their recorded scope.

The application owner can also invite members with administrator, editor or read-only access to that application. These invitations expire after seven days and require sign-in with the invited verified email. Accepted access continues until membership is removed. Administrators manage members and certificate publication; editors work with context, documents and assessments; read-only members consult authorized materials and results. Subscription payments and account billing remain with the owner.

4. Contracting

Purchases are confirmed through Stripe from each application’s Subscription section. The plan, price and renewal are shown before payment. Annual billing still provides one assessment per month, rather than twelve assessments at purchase.

Submitting materials saves the ZIP. Analysis starts manually, under the selected delivery rule or as the included monthly assessment. An extra assessment waits for confirmation and payment; uploading a ZIP does not authorize an automatic extra charge. Stripe processes card data; Promethia retains necessary customer, subscription, order and payment confirmation references. Internal failures and transport retries of the same request do not create another billable assessment.

In Stripe, you can choose to save your payment method for display in future purchases. This is optional and does not authorize extra charges without confirming each purchase; the subscription renews on its stated schedule.

5. Cancellation and withdrawal

You can cancel renewal in Subscription; access continues until the paid period ends and future renewals stop. Cancelling renewal does not by itself refund the already paid period. Applicable statutory withdrawal and refund rights remain. Before starting during a statutory withdrawal period, we collect your express request to begin and acknowledgement that the right may end once the service is fully performed. If we do not deliver a purchased extra assessment, we refund its price.

6. Your obligations

You must have the rights holder’s authorization to share source code and evidence. Assessment context and questions are shared with the invited team; do not include unrelated confidential information.

The team may submit a ZIP up to 25 MiB only through GitHub Actions. Exclude secrets, credentials, customer personal data, installed dependencies and the .git directory. We retain all accepted ZIPs privately without overwriting; identical retries share the same bytes. Each assessment uses one immutable ZIP. The main certificate date is the first receipt date of that ZIP; actual analysis and issuance dates remain separate. A certified ZIP can be reassessed using the current context, profiles and sources. Each assessment issues its own certificate and preserves previous certificates unchanged. We do not execute submitted code. Each ZIP has a SHA-256 fingerprint.

Before analysis, we agree components, permitted techniques, limits, data processing and execution conditions. You must disclose restrictions or missing materials that prevent a meaningful assessment. Do not send credentials or sensitive materials by email. Any additional support channel must be expressly agreed.

7. Scope and limitations

Automated findings are produced without human validation and must not be represented as human-reviewed. The assessment describes technical and documentary evidence within the agreed scope, including unresolved requirements and missing operational facts. A signed certificate records the dated findings; neither the report nor the certificate guarantees legal compliance or replaces legal advice. Completion does not mean approval. Later changes are outside the recorded version and scope.

8. Confidentiality and intellectual property

We treat non-public code and business information as confidential and use it only to perform the assessment. The applicant retains ownership of submitted materials. Promethia retains its standard, methodology and review format. Assessments requested through your account remain private. Accepting the terms or paying does not authorize publication.

9. Liability

To the maximum extent permitted by law, our total liability arising from an assessment is limited to the amount paid for it, and we are not liable for indirect or consequential loss. Nothing in these terms excludes liability that cannot legally be excluded or limits mandatory consumer rights.

10. Changes and applicable law

The terms published when you order or manually contract the assessment apply to it. These terms are governed by Spanish law without prejudice to mandatory protections in your country of residence.