# Coreload Terms of Service

Last updated: 6 November 2026.

These terms are an agreement between Coreload LLC, a Puerto Rico limited liability company ("Coreload", "we", "us"), and the organization that installs the
Coreload CI GitHub App or uses the Coreload sandbox API ("you"). By installing the App, creating an API key or running
work on Coreload, you accept them on behalf of that organization, and you confirm you may bind it.

The Acceptable Use Policy, the Privacy Policy, the Data Processing Addendum and the price list on our pricing page are
part of these terms.

## 1. The service

1.1 Coreload runs your GitHub Actions jobs, and work sent through the sandbox API, in virtual machines ("VMs") on
bare-metal machines that we operate and share between customers. A VM serves one customer only. For hosted CI, each VM
runs one job and is destroyed when that job ends. A sandbox is a VM that runs the commands you send it until you
destroy it or its time limit ends, and is then destroyed.

1.2 The service is in beta. We may add, change or remove features. When a change takes away something you rely on, we
tell you before it happens where we reasonably can.

1.3 You connect hosted CI by installing the Coreload CI GitHub App on a GitHub organization of your own and choosing
the private repositories it may serve. The App asks GitHub for only the permissions listed in our security
documentation.

1.4 The service is for businesses. You may not use it as a consumer, and the person accepting these terms must be at
least eighteen.

## 2. Your account and your responsibilities

2.1 Keep your GitHub organization, your API keys and the credentials your workflows use secure, and tell us at once if
one may have leaked. We may revoke a key or an installation that we believe is exposed.

2.2 You are responsible for what your jobs and sandboxes run, for having the rights to the code and data you give
them, and for your use following the law and the Acceptable Use Policy.

2.3 You may not resell the service, offer it to others as a hosting or compute service, or let a third party run
work through your organization or keys, unless we agree in writing.

## 3. Fees and prepaid credit

3.1 **Preview, then prepaid.** During the preview, access is by invitation and free of charge. Prepaid billing applies
once self-serve sign-up opens, and 3.2 to 3.9 apply from then. From then, you pay in advance by buying credit
("top-ups") by card, through our payment processor, Stripe. Your organization's jobs start once its settled paid
top-ups reach $100 in total; below that, no job runs. After that, we start a new job only while
your credit, less usage not yet billed, covers it. When it runs out, new jobs wait until you top up, and GitHub cancels
a job that waits more than a day for a runner. A job already running when your credit runs out is allowed to finish,
and its usage beyond your credit is charged to you through Stripe.

3.2 **Rates.** Usage is charged at the price list in force when the work runs, by the second of VM time, with no
per-job minimum. The price list is on our pricing page.

3.3 **Price changes.** We may change the price list. A price rise applies only to usage after it takes effect, and we
publish it on the pricing page at least fourteen days before then. A price cut takes effect at once.

3.4 **Promotional credit.** Once your organization's settled paid top-ups reach $100, a top-up
paid with a card that no other organization has paid us with adds promotional credit worth 10,000
vCPU-minutes at the highest per-vCPU rate on the price list. It is given once per organization. It is subject to
monthly availability, expires 30 days after the top-up that unlocks it, and is spent
before paid credit. Any other promotional offer states its own amount, expiry and conditions where we make it.
Promotional credit of every kind (free, bonus, matched or referral credit) is not money: it has no cash value, cannot
be transferred, refunded (including when these terms end) or exchanged for cash, is spent before paid credit, and
expires at the latest twelve months after it is granted. Refunds only ever cover money you actually paid. We may end or change
promotional offers for the future at any time; credit already added keeps its terms, except while paused under 3.5.

3.5 **Abuse review.** If we suspect your organization of abusing promotional credit, we may pause its promotional
credit while we review it, and start jobs only as far as your paid credit covers them. A pause is not a suspension; suspension is
section 7.

3.6 **Refunds.** Paid credit does not expire. Prepaid credit is not refundable, except where the law requires a
refund, and except that we refund unused paid credit to the paying card when we end these terms for convenience under
7.2, or when you end them because you do not accept a change under 12.2 or a new subprocessor under the Data
Processing Addendum. Promotional credit is never refunded.

3.7 **Taxes.** Prices exclude taxes, such as sales and use tax (including Puerto Rico's IVU) and VAT. Stripe adds the
tax that applies at checkout, from your billing address, and your credit is the amount before tax.

3.8 **Payment risk and fraud.** We may refuse, cancel or refund any payment, and suspend or close your organization,
if we suspect fraud or payment risk (for example a prepaid or anonymous card, a chargeback, or an early fraud warning
from the card network), abuse of the service, or a breach of the Acceptable Use Policy. In that case any refund of
unused paid credit is at our discretion, and promotional credit is forfeited.

3.9 **Chargebacks.** If a payment is reversed or charged back, we may suspend your organization at once, remove the
credit that payment bought, and recover from you the amount reversed and the fees and costs the reversal caused us.

## 4. Your data

4.1 You own your code, build inputs and outputs, logs and everything else your jobs process ("Customer Data"). You give
us only the rights we need to run the service for you, and we use Customer Data for nothing else. We do not use it to
train models.

4.2 A VM's disk and memory are destroyed with the VM. We do not store your secrets. For hosted CI, we do not keep
copies of your job logs or artifacts: they stay on GitHub. For a sandbox, our sandbox service keeps each command's
output in its memory so that you can read it, until newer output needs the space or the service restarts. The
operational records we keep, and for how long, are in the Privacy Policy.

4.3 Where we process personal data in Customer Data for you, the Data Processing Addendum applies, and it forms part of
these terms.

## 5. Security

We keep each customer's work in its own VMs, give the App only the permissions it needs, limit what a VM can reach on
the network, hold the App's private key in a managed key service, and change production only through reviewed
automation. The Data Processing Addendum lists these measures and says how we tell you about a breach.

## 6. Intellectual property and feedback

6.1 We keep all rights in the service, our software and our documentation; you keep all rights in Customer Data.
Nothing in these terms transfers either.

6.2 If you send us suggestions or feedback, we may use them freely, without any duty to you.

## 7. Suspension and termination

7.1 We may suspend your organization, an installation or a key at once, without notice, if we reasonably believe the
Acceptable Use Policy is being broken, a key or installation is compromised, a payment is fraudulent, reversed or
charged back (3.8 and 3.9), the law requires it, or the service or other customers are at risk. Suspension stops new jobs and destroys running VMs. We tell you promptly, with the
reason, and lift the suspension once the cause is resolved.

7.2 You may stop at any time by uninstalling the App and revoking your keys. You may end these terms at any time by
telling us. We may end them for any reason with thirty days' written notice. Either party may end them at once if the
other materially breaks them and does not fix the breach within ten days of being told.

7.3 When these terms end, new jobs stop and running VMs are destroyed. Unused paid credit is refunded only as 3.6
says. Sections 3.6 to 3.9, 4, 6, 8, 9, 10 and 12 continue to apply.

## 8. Warranties

8.1 We will provide the service with reasonable skill and care.

8.2 Apart from 8.1, and to the extent the law allows, the service is provided **as is and as available**. We give no
other warranty, express or implied, including of merchantability, fitness for a particular purpose, title or
non-infringement, and we do not promise that the service will be uninterrupted, error-free or available at any
particular time. There is no uptime commitment and there are no service credits, unless a signed order says otherwise.

## 9. Liability

9.1 Neither party is liable to the other for any indirect, incidental, special, consequential or punitive damages, or
for lost profits, revenue, goodwill or data, however caused, even if told they were possible.

9.2 Each party's total liability arising from these terms or the service is limited to the amounts you paid us in the
three months before the event giving rise to the claim.

9.3 Sections 9.1 and 9.2 do not limit your duty to pay fees, our duty to refund unused paid credit where 3.6 requires it,
either party's liability under section 10, or any
liability the law does not allow to be limited, such as for fraud, or for death or personal injury caused by
negligence.

## 10. Indemnity

You will defend us against any claim by a third party arising from Customer Data, from what your jobs or sandboxes
did, or from your breach of the Acceptable Use Policy, and pay the amounts awarded or agreed in settlement of it. We
will tell you promptly about the claim, let you control its defence and settlement (you may not settle in a way that
admits fault for us or binds us without our consent), and give you reasonable help at your cost.

## 11. Export controls and sanctions

You will use the service in line with the export control and sanctions laws that apply to you and to us, including
those of the United States. You confirm that neither you nor anyone who controls you or uses the service through you
is the target of those sanctions, or is located in a country or region subject to comprehensive sanctions. We may
suspend or end the service at once where continuing would break those laws.

## 12. General

12.1 **Governing law and courts.** These terms are governed by the laws of the State of Delaware, without regard to
its conflict of laws rules. The parties submit to the exclusive jurisdiction of the state and federal courts located in Delaware, except that either
party may seek urgent injunctive relief in any court that has jurisdiction.

12.2 **Changes to these terms.** We may update these terms. We publish each version on this page with its date. A
material change takes effect at least thirty days after we publish it; any other change takes effect when published.
A change to the price list follows 3.3 instead.
If you do not accept a change, you may end these terms before it takes effect and, if you have bought paid credit, have
your unused paid credit refunded. Using the service after a change takes effect means you accept it.

12.3 **Notices.** We send notices to the contact details your organization gave us, or through the App's installation.
You send notices to hello@coreload.com, and abuse reports to the address in the Acceptable Use Policy. Our postal
address is D81 Calle C, STE 301, Dorado, PR 00646.

12.4 **Other terms.** You may not assign these terms without our consent; we may assign them to an affiliate or a
successor to our business. Neither party is liable for delays caused by events beyond its reasonable control. If a
provision is unenforceable, the rest stays in force. Failing to enforce a provision is not a waiver. These terms, with
the documents named at the top, are the whole agreement between us on their subject and replace anything earlier on
it, unless a signed order says otherwise.