1. Who these terms are between
These Terms of Service (the "Terms") are an agreement between CitrusWeb ("CitrusWeb", "we", "us") and the manufacturing business that subscribes to or evaluates CitrusWeb Works ("you", "your", the "Customer"). If you accept these Terms on behalf of a company, you confirm you are authorized to bind that company.
CitrusWeb Works runs as its own product, in its own environment, separate from any studio or agency tooling. A session in one never grants access to the other.
2. What the service is
CitrusWeb Works is a multi-tenant software service for small and mid-size manufacturing shops. It helps you review, route, and act on shop workflow data, including RFQs, inbound customer email, public federal opportunity data, and related records.
It is focused workflow software. It is not an ERP replacement, a machine-control system, or a system of record for regulated engineering release. AI features classify, extract, summarize, and draft. Their output is a draft for a person to review, edit, and approve. You remain responsible for approving any customer-facing commitment, price, delivery date, legal language, or credit decision before it is sent or acted on.
3. Your data belongs to you
As between you and CitrusWeb, you own the data you enter, upload, or import into the platform (the "Customer Data"). We process it only to provide the service to you, acting as your data processor on your instructions.
You can export your Customer Data to CSV on demand. On cancellation you can export before deletion. We do not sell your data and we do not use it to train AI models. Your data is never held hostage.
4. Acceptable use
You agree to use CitrusWeb Works lawfully and only for your own manufacturing business. You will not:
- •Upload data you do not have the right to share, or that infringes another party's rights.
- •Attempt to access another tenant's data, probe or bypass the isolation controls, or disrupt the service.
- •Use the service to send unlawful, deceptive, or unsolicited bulk communications.
- •Rely on AI-generated output as a final decision without human review, where that output commits you to a customer, a price, a date, or a legal or credit position.
- •Reverse engineer, resell, or sublicense the service except as expressly permitted.
5. Export-controlled data is prohibited
This is a hard limit at launch, not a preference. CitrusWeb Works is built for ISO 9001 and AS9100 shops doing commercial and build-to-print work. It is not yet built to hold export-controlled technical data.
You must not upload, store, or transmit through the platform any technical data controlled under the International Traffic in Arms Regulations (ITAR), the Export Administration Regulations (EAR), or any Controlled Unclassified Information (CUI), including controlled drawings, prints, and specifications.
Reading public federal opportunity data (for example, discovery of SAM.gov postings) is fine. The prohibition is on uploading controlled technical data into quoting, inspection, or file features. If you handle ITAR, EAR, or CUI technical data, keep it out of the platform and talk to us before onboarding those workflows.
6. Subprocessors
To deliver the service we rely on a small set of named, reputable subprocessors. Each processes only what it needs for its role:
- •Anthropic, the AI provider (Claude), which processes the specific content you submit to an AI feature. Anthropic does not use data submitted through its API to train its models.
- •Vercel, for application hosting, serverless functions, and request handling. US-region hosting.
- •Supabase, for the database, authentication, and file storage where your Customer Data is held behind row-level security.
- •Postmark, for transactional and outbound email delivery, which processes recipient addresses and message bodies.
7. AI processing
AI features send only the content needed for the specific task, for example the RFQ you upload or the inbound email you route, plus a fixed instruction prompt. We do not send your whole database to the AI. The engine is instructed to use only facts present in the content you provide and to never invent dates, prices, quantities, or tracking numbers.
AI output is always a draft for a human to review and approve. Nothing the AI writes is sent to your customer automatically.
8. Availability
We aim for reliable, always-available service and use established infrastructure providers to support that. At this stage, however, availability is provided on a best-effort basis. We do not offer a financial service-level agreement or SLA credits.
We may perform maintenance, and the service may be unavailable from time to time. We will make reasonable efforts to limit disruption.
9. No other warranties
The service is provided "as is" and "as available". Except as expressly stated in these Terms, and to the fullest extent permitted by law, CitrusWeb disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.
We do not currently hold SOC 2, ISO 27001, CMMC, or HIPAA certification, and we do not represent that we do. What we do provide is described in these Terms and in our security posture: encryption in transit and at rest, tenant isolation by row-level security, an AI provider that does not train on your data, human-in-the-loop AI, and CSV export.
10. Limitation of liability
To the fullest extent permitted by law, CitrusWeb is not liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill, arising from your use of the service.
Our total aggregate liability arising out of or related to the service will not exceed the amount you paid us for the service in the twelve months before the event giving rise to the claim.
11. Suspension and termination
You may cancel your subscription at any time. We may suspend or terminate access if you breach these Terms, including the export-control prohibition or acceptable use, or where required to protect the service or other customers.
On termination you can export your Customer Data to CSV. After a 30-day post-cancellation grace period, your Customer Data is deleted on schedule or on your earlier request, subject to the retention described in our Privacy Policy.
12. Changes and contact
We may update these Terms as the product matures. Material changes will be communicated before they take effect. If we add a new subprocessor, we will update the list above and give notice.
Questions about these Terms can be sent to legal@citrusweb.works.