General Terms of Sale

Part 1 — Provisions common to all sales

Article 1 — Purpose and definitions

These General Terms of Sale govern the sale, by ASC (the “Publisher”), of DarkMoon's paid editions and services. The following terms are used:

• Client: any natural or legal person who orders a paid service, referred to as a “Professional” when acting for the purposes of their business, and as a “Consumer” when acting for purposes outside their business (preliminary article of the French Consumer Code).
• Pro edition: the enhanced version of DarkMoon, self-hosted by the Client, unlocked by a hardware-bound licence key.
• Pentest on Demand service: a security audit engagement performed by the Publisher (Part 4).
• Partner Programme: a resale scheme reserved for approved professionals (Part 5).
• Services: all paid editions and engagements; the open-source Community edition is excluded.

Article 2 — Contractual documents

The contractual documents and their order of precedence are defined in Article 2 of the Terms of Use, which applies to these Terms. Any purchasing conditions issued by a Professional Client are set aside absent the Publisher's written acceptance; where the parties' general conditions conflict, the incompatible clauses are mutually neutralised (Article 1119, second paragraph, of the French Civil Code), the active acceptance of these Terms at the time of the order attesting to their application.

Article 3 — Order and formation of the contract

The order is placed online. It requires prior acceptance of these Terms of Sale by way of a non-pre-ticked checkbox referring to their downloadable version, together with confirmation of payment (double-click, Articles 1127-1 and 1127-2 of the French Civil Code). The Publisher provides the Client, on a durable medium (email with a time-stamped PDF file), with the version of the Terms of Sale accepted, which it archives as evidence.

Article 4 — Prices

Prices are stated in euros. For Professionals, they are exclusive of tax; for Consumers, they are inclusive of all taxes. The applicable value added tax is added to the tax-exclusive prices. The applicable price is the one displayed at the time of the order. The prices in force are shown on the website and in the order flow: Pro edition (monthly or annual subscription); Enterprise/Custom edition on quotation; Pentest on Demand at the price indicated before payment, adjusted to the scope.

Article 5 — Payment terms and suspension for non-payment

Payment is made by the means offered at the time of the order, via the provider Stripe. For subscriptions, payment is recurring. In the event of a Professional Client's default of payment, access to the Service and, where applicable, the licence key may be suspended or blocked as of right, access being restored after settlement. As regards a Consumer, suspension is subject to a prior formal notice that has remained without effect within a reasonable time.

Article 6 — Suspension for unlawful use

Without prejudice to any other right, the Publisher may suspend access to the Services in the event of use contrary to the Acceptable Use Policy or to the law. In the event of manifestly unlawful use or serious risk, suspension may be immediate; in other cases, it is preceded by a formal notice that has remained without effect.

Article 7 — Artificial intelligence and the nature of the obligation

The Client is informed that DarkMoon incorporates artificial intelligence systems within the meaning of Regulation (EU) 2024/1689 (the AI Act). The Publisher is their provider; it is not the provider of the underlying models when these are operated by third parties or locally. Subject to the classification analysis under way, the Publisher considers, given the product's security-audit purpose, that it qualifies as a limited-risk system. Where the product interacts directly through a conversational interface, the user is informed that they are interacting with an AI system, and the generated reports are produced with AI assistance. The results of the automated analysis may contain false positives and false negatives and do not guarantee the exhaustiveness of the vulnerabilities present; they must be reviewed by a qualified professional before any decision. Between Professionals, the Publisher's obligation is a best-efforts obligation (obligation de moyens); this qualification does not affect the strict liability owed to a Consumer under Article L. 221-15 of the French Consumer Code.

Article 8 — Force majeure

Neither party may be held liable for a breach resulting from a force majeure event meeting the criteria of Article 1218 of the French Civil Code (an event beyond the party's control that could not reasonably be foreseen or avoided). The failure of a provider freely chosen by a party does not, in itself, constitute a force majeure event. The Publisher's own failures, or those of its own providers, are not enforceable against a Consumer.

Article 9 — Personal data

The processing of personal data is governed by the Privacy Policy. Where the Publisher acts as a processor of the Client, the Data Processing Agreement applies.

Article 10 — Language and evidence

The contract is drafted in French; in the event of translation, the French version prevails. Between Professionals, the Publisher's time-stamped records and logs constitute evidence. This evidence agreement is not enforceable against a Consumer, in respect of whom evidence may be adduced by any means in accordance with the general law.

Part 2 — Terms of Sale applicable to Professional Clients (Pro edition)

This Part governs the supply of the Pro edition and the associated engagements to Professional Clients. It supplements Part 1.

Article 1 — Nature of the offering

The Pro edition is supplied as a licence to use software self-hosted by the Client, together with ancillary services (dashboard, signed reports, updates, support). Test data remains on the Client's infrastructure; the Publisher does not host it. Access to the features is unlocked by a licence key bound to the hardware fingerprint of the authorised machines.

Article 2 — Grant of licence

The Publisher grants the Client, for the duration of the subscription, a personal, non-exclusive, non-assignable and non-transferable right to use the Pro edition, for the number of machines subscribed. The Client shall not sub-licence, resell (outside the Partner Programme), rent out or circumvent the technical limitation measures. These prohibitions do not stand in the way of the mandatory (public-policy) prerogatives of the lawful user provided for in Article L. 122-6-1 of the French Intellectual Property Code, in particular the making of a back-up copy (II), the observation and study of the software's operation (III) and decompilation for interoperability purposes (IV), including where the latter requires the circumvention of a technical measure under the strict statutory conditions. The licence key is validated at start-up; an expired or invalid key prevents the Pro features from being unlocked.

Article 3 — Term, renewal and termination

The subscription is taken out for the chosen period (monthly or annual) and renews tacitly for periods of the same duration, unless terminated before the expiry date subject to thirty (30) days' notice for the annual subscription and seven (7) days' notice for the monthly subscription. Termination takes effect at the end of the current period; sums paid for the period started are not refunded, save for any contrary statutory provision.

Article 4 — Prices and payment conditions

Prices are exclusive of tax. In accordance with Article L. 441-10 of the French Commercial Code, any late payment gives rise, as of right, to late-payment penalties at a rate equal to three times the statutory interest rate and to a fixed recovery-cost indemnity of 40 euros, without prejudice to additional compensation on production of supporting documents. Price revisions apply on the anniversary date, subject to thirty (30) days' notice; a Client who refuses them may terminate free of charge before they take effect.

Article 5 — Service levels and support

The Publisher provides email support according to the level subscribed. As the Pro edition is self-hosted, its availability depends on the Client's infrastructure and is not guaranteed by the Publisher. For the online services actually operated by the Publisher only (for example the portal), the Publisher undertakes a reinforced best-efforts obligation with an availability target of 99.5% per month, excluding scheduled maintenance and force majeure; where applicable, breaches are compensated exclusively by credits according to the schedule in the special conditions. No quantified service level is guaranteed for the standard self-hosted Pro edition.

Article 6 — Updates and evolutions

The Publisher provides corrective and security updates for the duration of the subscription and may make the features evolve, without any substantial reduction of the essential subscribed features without prior information to the Client.

Article 7 — Intellectual property and Client data

The Pro edition and its components remain the property of the Publisher. The Client remains the sole holder of its data, test results and reports, to which the Publisher has no access in the self-hosted edition. The Publisher does not reuse the Client's data, results or reports for the purpose of improving its models or for statistics, save for the Client's written, express and separate agreement providing for effective anonymisation.

Article 8 — Warranties and warranty against eviction owed by the Publisher

The Publisher warrants that the Pro edition conforms to its documentation under normal conditions of use; this warranty does not cover malfunctions resulting from non-compliant use, unauthorised modification, the Client's environment or the use of the Community edition. The Publisher indemnifies the Client against any third-party action based on an infringement of an intellectual property right arising from the Pro edition; in this respect, it takes charge of the Client's defence and of any awards, within the limit of the cap in Article 9, and may, at its expense, render the product non-infringing, replace it or terminate while refunding the unused portion. As this is security software, no obligation of result is owed as to the exhaustive detection of vulnerabilities.

Article 9 — Limitation of liability

The Publisher's liability is engaged on the basis of a best-efforts obligation. It is limited, all damages and all triggering events combined, to the higher of the following two amounts: the total sums paid by the Client in respect of the twelve (12) months preceding the triggering event, or a floor of 5,000 euros. Excluded are indirect damages (in particular loss of operations, of turnover, of clientele or of image) as well as, for the ancillary online services operated by the Publisher only, the loss of data beyond the last available back-up. Neither the limitation nor the exclusion above covers: wilful misconduct and gross negligence; bodily injury; infringement of intellectual property rights; breach of the confidentiality obligation (Article 11); and the Publisher's obligations relating to personal data protection, governed by the Data Processing Agreement and Article 82 of the GDPR. The statutory warranty against hidden defects (Articles 1641 et seq. of the French Civil Code) remains applicable.

Article 10 — Compliance with the Acceptable Use Policy and indemnification by the Client

The Client complies with and ensures compliance with the Acceptable Use Policy. It represents and warrants that it holds, for each system tested, a written, prior and valid authorisation from its owner or operator. The Client indemnifies the Publisher against any third-party claim resulting from a use of the product that does not comply with this Policy or with the law, and compensates it for the resulting consequences, including reasonable defence costs. This indemnification obligation of the Client is capped on the same conditions as Article 9, except where the claim results from unauthorised, fraudulent or unlawful use attributable to the Client, in which case it applies without any cap.

Article 11 — Confidentiality

Each party keeps confidential the non-public information received from the other, for the duration of the contract and five (5) years after its end.

Article 12 — Hardship (imprévision)

Each party, being a Professional, waives the benefit of Article 1195 of the French Civil Code and assumes the risk of an unforeseeable change of circumstances.

Article 13 — Governing law and jurisdiction

The contract is governed by French law. For any dispute between the Publisher and a Client having the status of trader (commerçant), exclusive jurisdiction is conferred on the competent court of Toulouse (commercial court or economic-activities court depending on the nature of the dispute), pursuant to Article 48 of the French Code of Civil Procedure. Failing application of that article (a professional Client that is not a trader), the competent courts are determined by the general law. This clause does not stand in the way of the jurisdiction of the courts seised for the purpose of interim or protective measures.

Part 3 — Terms of Sale applicable to Consumers

This Part applies where the Client is a Consumer or a non-professional. In the event of conflict with Part 2, it prevails for the Consumer's benefit. Its provisions are mandatory (public policy).

Article 1 — Pre-contractual information (distance selling)

Before the order, the Consumer receives, in a legible and comprehensible manner, the information set out in Articles L. 111-1 and L. 221-5 of the French Consumer Code: essential characteristics, functionalities, compatibility and interoperability of the service; prices inclusive of all taxes; identity and contact details of the Publisher (including telephone); duration and conditions of termination; existence and arrangements of the statutory warranties; conditions, time limit and arrangements of the right of withdrawal, together with the model form; a warning about the proportional payment due in the event of early performance; and the contact details of the consumer ombudsman (médiateur de la consommation). The order flow presents these elements prior to confirmation.

Article 2 — Order and confirmation

Before confirmation, the details and the total price are displayed. The confirmation button bears the wording “order with obligation to pay”, on pain of nullity of the order (Article L. 221-14 of the French Consumer Code). In accordance with Article L. 221-13, the Publisher confirms the contract on a durable medium at the latest when performance of the service begins, this confirmation reproducing all the pre-contractual information and the model withdrawal form.

Article 3 — Right of withdrawal

The Consumer has a period of fourteen (14) days to withdraw without reason (Article L. 221-18 of the French Consumer Code). This period runs from the conclusion of the contract for digital services and content. Withdrawal is exercised by means of the model form or of any unambiguous statement sent to contact@asc-it.fr. In the event of withdrawal, the Publisher refunds all sums paid at the latest fourteen (14) days after being informed of it, by the same means of payment (Article L. 221-24).

Article 4 — Immediate performance and waiver

If the Consumer wishes performance to begin before the end of the withdrawal period, they make an express request for this. Two regimes apply depending on the nature of the engagement:

• Subscription to the Pro edition and online services (provision of a service): in the event of withdrawal after a request for early performance, the Consumer pays an amount proportional to the service provided up to their decision (Article L. 221-25); the right lapses where the service has been fully performed with their express agreement and waiver.
• One-off digital content supplied without a tangible medium with instant performance (for example a licence key or a single download delivered immediately): in accordance with Article L. 221-28, 13°, the right of withdrawal is lost if the Consumer has given their prior express agreement to the start of performance and expressly waived that right, this loss being confirmed to them.

A dedicated, non-pre-ticked checkbox collects this request and this waiver at the time of payment. Failing this, the right of withdrawal remains intact and, if the information was missing, the period is extended by twelve (12) months (Article L. 221-20).

Article 5 — Statutory warranties

The Consumer benefits from the statutory warranty of conformity of digital content and services (Articles L. 224-25-1 et seq. of the French Consumer Code, transposing Directive (EU) 2019/770) and from the warranty against hidden defects (Articles 1641 et seq. of the French Civil Code). For a service supplied continuously, conformity is owed throughout the supply period; defects appearing during this period are presumed to have existed as from supply, the burden of proof lying with the Publisher. The Publisher provides the updates necessary to maintain conformity. The Consumer may suspend payment of the price still due in the event of an uncorrected lack of conformity. Any clause excluding or limiting these warranties as regards the Consumer is deemed unwritten.

Article 6 — Term, renewal and termination

In accordance with Article L. 215-1 of the French Consumer Code, the Publisher informs the Consumer, in writing and in a conspicuous box, at the earliest three (3) months and at the latest one (1) month before the end of the period, of their option not to renew the contract. Failing this, the Consumer may terminate free of charge at any time from the renewal, sums paid in advance being refunded pro rata. Any price revision at renewal is notified with prior notice and gives the Consumer the right to terminate free of charge before it takes effect. Where the contract was concluded electronically, a free online termination feature is accessible at any time from the client area (Article L. 215-1-1 of the French Consumer Code).

Article 7 — Liability

The Publisher is strictly liable for the proper performance of the contract (Article L. 221-15 of the French Consumer Code), under the conditions of the general law and of the statutory warranties. No clause limiting or excluding liability applies to the Consumer. The warning relating to the limits of the automated analysis (Part 1, Article 7) is information about the nature of the service, not an exclusion.

Article 8 — Lawful use of the tool

DarkMoon is an offensive security tool. Its use is lawful only on systems that the Consumer owns or for which they hold a prior written authorisation. Any other use is liable to constitute a criminal offence (Articles 323-1 et seq. of the French Criminal Code).

Article 9 — Dispute resolution and jurisdiction

In the event of a dispute, the Consumer first sends a written complaint to customer service (contact@asc-it.fr). Failing a solution, they may resort free of charge to the consumer ombudsman, whose contact details are specified in the pre-contractual information. The Consumer may bring the matter, at their choice, before the court of their place of domicile; no clause derogates from this. French law applies, without depriving a Consumer residing in another Member State of the mandatory provisions of the law of their residence.

Part 4 — Special conditions of the Pentest on Demand service

The “Pentest on Demand” service is a security audit engagement performed by the Publisher on the Client's behalf, distinct from the supply of software. It supplements Part 1 and, depending on the status of the Client, Part 2 or Part 3.

Article 1 — Purpose

The Publisher performs, on the scope defined with the Client, a penetration test resulting in a documented report and a debrief. The process comprises: the definition of the scope, the electronic signature of an authorisation framework, payment, scoping by an expert, performance of the audit, delivery of the report in a secure client area, then a debrief by video conference.

Article 2 — Authorisation, verification and scope (essential condition)

Performance of the audit is subject to the electronic signature, by an authorised representative of the Client, of an authorisation mandate identifying the authorised assets, the exclusions, the environment and the intervention window. The Client represents and warrants that it owns the targeted systems or holds the written authorisation of their owner. The electronic signature is time-stamped and accompanied by the retention of the signatory's IP address and user agent; it constitutes a simple electronic signature within the meaning of Regulation (EU) No 910/2014 (eIDAS), admissible in evidence without a presumption of reliability, the burden of proving its integrity lying with the Publisher. The Publisher furthermore carries out an independent verification of the ownership or control of the declared assets (for example checking WHOIS/DNS records, proof of domain control, verification of the Client's identity), the own criminal liability of each participant under Articles 323-1 et seq. of the French Criminal Code not being capable of being neutralised by the Client's declaration alone. The Client indemnifies the Publisher against any claim resulting from an inaccurate declaration.

Article 3 — Price and payment

The price is the one indicated to the Client before payment, adjusted to the final scope, with no hidden charge. The engagement begins after collection of payment.

Article 4 — Progress, deadlines and subcontracting

The stages follow the cycle: project, awaiting payment, paid, scoping, in progress, drafting, report delivered, debrief scheduled, closed. The report is typically delivered a few business days after scoping, the firm deadline being set in the contractual framework. The Client provides its cooperation; any delay attributable to it extends the deadlines. The Publisher may use a subcontractor for the performance of the engagement subject to prior information to the Client, remaining responsible for its acts; the Client may object to a subcontractor on a legitimate ground.

Article 5 — Confidentiality and security of the deliverables

The report and the vulnerability data are highly confidential. They are kept outside the web root and delivered via authenticated access with logging of downloads. The Publisher applies the security measures described in the Privacy Policy, and neither reuses nor publishes the Client's data without its written agreement; any communication for statistical or research purposes requires effective anonymisation and the Client's prior agreement.

Article 6 — Personal data protection

Where the scope is liable to contain third parties' personal data, the Client is the data controller and the Publisher acts as a processor (Article 28 of the GDPR); the Data Processing Agreement applies. The Client minimises the scope accordingly. Data relating to the engagement kept in the active database is deleted at the latest sixty (60) days after delivery of the report; the copies contained in the back-ups, isolated and with restricted access, are not re-exploited and disappear by rotation within the back-up retention period indicated in the Privacy Policy. The statutory retention periods (accounting, evidentiary) remain reserved.

Article 7 — Ownership of the deliverables

The report and the deliverables become the property of the Client upon full payment of the price; until then, the Publisher retains ownership. This reservation concerns the document and affects neither the Client's rights in its own data nor its data-protection obligations. The Publisher retains ownership of its pre-existing methods, know-how and tools.

Article 8 — Limitation specific to the engagement

Without prejudice to the statutory warranties owed to a Consumer, and as regards Professionals: (i) the Publisher's liability for a breach of the audit obligation (in particular the incompleteness of the vulnerabilities detected) is limited to the amount paid for the engagement concerned; (ii) the Publisher's liability for material damage caused by the active performance of the tests (for example a service interruption or an out-of-scope action) is limited under the conditions of Article 9 of Part 2. The cap exclusions of that same article (wilful misconduct, gross negligence, bodily injury, intellectual property, confidentiality, data protection) apply. A penetration test is a snapshot and does not guarantee the absence of any vulnerability; the Publisher's obligation is a best-efforts obligation in line with the state of the art (OWASP, NIST SP 800-115, MITRE ATT&CK methodologies).

Part 5 — Partner Programme conditions (resellers and MSSPs)

This Part governs the relationship between the Publisher and approved reseller partners. It applies exclusively to professionals and supplements Parts 1 and 2.

Article 1 — Nature of the programme

The programme is based on a buy-and-resell model: the Partner buys licence keys at a discounted price and resells them to its own clients, at its own margin and under its own responsibility, in its own name and on its own account. It entails neither mandate, nor exclusivity, nor representation; the Partner shall not negotiate or conclude in the name of the Publisher. The programme constitutes neither a commercial agency contract (Article L. 134-1 of the French Commercial Code) nor a franchise.

Article 2 — Approval

Access to the programme is subject to prior approval, including verification of the company's identity (SIREN/SIRET, equivalent registration, or VAT number). The Publisher examines applications within two (2) business days and may accept them, refuse them or suspend a Partner for a breach.

Article 3 — Tiers and discounts

Discounts depend on the tier reached, calculated on rolling sales over the last twelve (12) months, according to the following indicative grid:

• Partner: indicative discount of up to 30% — with no annual maintenance quota.
• Silver: indicative discount of 35% — indicative annual maintenance quota of 25 Pro licences / 5 Enterprise.
• Gold: indicative discount of 40% — indicative annual maintenance quota of 50 Pro licences / 15 Enterprise.
• Platinum: indicative discount of 45% — indicative annual maintenance quota of 100 Pro licences / 25 Enterprise.

The grid may be revised by the Publisher on an objective ground, subject to three (3) months' notice and with no retroactive effect on orders already placed. Failure to meet a quota may lead to a move to the lower tier. The Publisher may apply a derogatory tier at its discretion.

Article 4 — Billing, termination and non-payment

Orders of keys are billed via Stripe, as a one-off payment or by subscription. In the event of non-payment or refund, the key concerned may be blocked as of right, access being restored after settlement.

Article 5 — Partner obligations and use of the trademark

The Partner presents the product fairly and in accordance with its documentation; it does not overstate the performance or the reach of the Privacy Gateway beyond the Publisher's descriptions; it complies with and ensures compliance with the Acceptable Use Policy. The Publisher grants the Partner a non-exclusive right to use the “DarkMoon” trademark solely for the purposes of promotion and resale, in compliance with the communicated usage rules (quality control); this right lapses automatically upon termination of the partnership and confers no property right.

Article 6 — End client

The Partner alone is in the relationship with its end client, whose identity is unknown to the Publisher. It assumes towards that client its own information and compliance obligations, in particular as regards data protection, and has each end client subscribe to a usage charter equivalent to the Acceptable Use Policy. It determines its own role (controller or processor) vis-à-vis its client.

Article 7 — Term and cessation

The relationship is entered into for an indefinite term and may be terminated by each party subject to a minimum notice indexed to seniority: three (3) months for less than one year of relationship, six (6) months from one to three years, twelve (12) months beyond, without prejudice to a longer notice period if economic dependence justifies it, so as to prevent any abrupt termination (Article L. 442-1, II, of the French Commercial Code). In the event of a serious breach (unlawful use, harm to the trademark, fraudulent declaration), termination may be immediate.

Article 8 — Liability and jurisdiction

The Publisher's liability towards the Partner is capped in accordance with Article 9 of Part 2. Disputes fall under the jurisdiction designated in Article 13 of Part 2.