Terms and Conditions

1. Who the agreement is between

• Us: Elastic Bean Software Limited, registered in Ireland (company number 814004), registered office Ballinastoe, Roundwood, Co. Wicklow, A98 YV67, Ireland.
• You: the organisation that creates the Bean Proof account. The person accepting these terms confirms they have authority to bind that organisation.

Bean Proof is for businesses only. It is not offered to consumers.

2. Words we use

• Service — Bean Proof: the web application, the Guide (AI assistant), public report pages, PDF packs, the verification page, and support.
• Employer — a legal entity whose gender pay gap report is prepared in Bean Proof.
• Your Data — everything you or your users upload or enter, including payroll and HR data about employees.
• Report — the figures, statement and documents the Service produces for an Employer for a reporting year.
• Plan — Essentials, Standard, Plus or Advisor, as described on our pricing page.
• Users — people you allow to use the Service under your account.

3. What Bean Proof does

Bean Proof helps you prepare, calculate, publish and keep evidence for the gender pay gap report required under the Irish Gender Pay Gap Information Act 2021 and its regulations. It:

• reads your payroll and HR exports and helps you find and fix problems;
• calculates the statutory figures using a fixed, versioned set of calculation rules;
• helps you draft the required statement;
• publishes your report on a hosted public page and produces the file for the Government portal;
• produces stamped, signed and verifiable PDF documents;
• keeps a record of every change and decision.

4. What stays your responsibility

Bean Proof does the calculating and record-keeping. The legal duty to report stays with the Employer. In particular, you are responsible for:

1. Your data being complete and correct. The figures can only be as good as the data. We point out likely problems; we cannot know your payroll better than you do.
2. The decisions you make in the Service — which date you count from, who is in or out, fixes you accept, assumptions you confirm.
3. Reviewing before you freeze and before you publish. Freezing a snapshot and publishing are one-way steps, and the Service asks you to confirm each one.
4. Your statement — the reasons for the gap and the measures you are taking are your words, even where the Guide drafted them.
5. Uploading to the Government portal and meeting your deadline. We produce the file and walk you through it; the upload is yours.
6. Having a lawful basis to share employee data with us and telling your employees, as their employer, how their data is used.

Bean Proof is not legal advice. The Guide explains the rules in plain words, but where something is a legal judgement it will say so, and you should confirm with your own adviser.

5. Accounts and users

• Keep sign-in details secure and tell us promptly about any unauthorised use.
• You are responsible for what your Users do in your account.
• Plans include a number of Users (Essentials 3, Standard 5, Plus and Advisor unlimited). If you go over, we will suggest an upgrade; we will not lock anyone out without first talking to you.

6. Free to prepare, paid to calculate

• Free: creating an account, uploading data, matching columns, the health check, fixing problems, the recap and talking to the Guide cost nothing, and need no card.
• Paid: calculating figures and everything after — drafts, the sense check, freezing, official PDFs, the public page and the portal file — requires a paid Plan for that Employer and reporting year.
• No figures are calculated or shown before payment.

7. Fees, renewal and refunds

• Price. Each Plan is a flat annual price per Employer (or per client Employer for Advisor), shown on our pricing page. Prices exclude VAT, which is added where it applies.
• Payment. By card through Stripe, or by invoice where we agree it. Invoices are due within 30 days.
• Subscription. Your first payment starts a 12-month subscription. It renews automatically each year ahead of the June snapshot date. We will email you at least 30 days before each renewal with the date and the price.
• Cancelling. Turn off renewal at any time from the Billing page in Bean Proof, or email us. Cancellation takes effect at the end of the paid year.
• Early-bird. Paying for the coming reporting year before its June snapshot date gets 15% off that year.
• Price changes apply only from your next renewal, and we will tell you at least 60 days in advance.
• Refunds. If you have not yet frozen a snapshot, you can ask for a full refund within 14 days of first payment. Once a snapshot has been frozen for that year, fees are not refundable, because the core work has been delivered.
• Late payment. If an invoice is more than 30 days overdue we will remind you, then may pause paid features after a further 14 days' notice. Published report pages stay online.

8. Plan rules

• Essentials and Standard cover one Employer. Size bands are by that Employer's headcount on the snapshot date.
• Plus covers up to five Employers under common ownership, by combined headcount; additional entities are charged per our pricing page.
• Advisor is for firms preparing reports for Employers they do not own. The firm must have each client's authority to upload that client's data and to act for it. A firm is responsible to us for its clients' use of the Service, and must pass our Data Processing Terms on to each client (or have the client accept these terms directly).
• Features marked "coming" are never part of what you pay for; they are added to the relevant Plans when released.

9. The AI assistant

• The Guide uses artificial intelligence. The Service always shows when content was suggested by it.
• AI suggests; people decide. Nothing the Guide suggests changes your data until a User accepts it. Accepted suggestions are recorded as "suggested by the assistant, accepted by [name]".
• Statutory figures are never produced by AI.
• AI output can be wrong. Check its suggestions and drafts before accepting them.
• Your Data is never used to train AI models or shared with other customers.

10. Publishing, public pages and official documents

• Public page. When you publish, your Report's figures and statement appear at a public web address. Individual employees' data is never published.
• Staying public. The law asks you to keep each report public for three years. We will keep each published report page online for at least three years from its publication date, even if your subscription ends, as a read-only page. You may ask us to take a page down; if you do, keeping your report public elsewhere becomes your responsibility.
• Corrections create a new version. The page shows the current version, and earlier versions remain available.
• Official documents carry a stamp, a verification code and a digital signature. Anyone with the document can confirm at our verification page that it matches the original. The verification page reveals nothing beyond what was already published.
• Documents marked DRAFT are not official and must not be presented as your published report.

11. Acceptable use

You must not:

• upload data you have no right to share, or data the Service does not need (for example health information);
• try to access another customer's data, test our security without our written permission, or overload the Service;
• copy, resell or build a competing product from the Service, or reverse-engineer it except where the law allows;
• use the Service to publish anything false, misleading or unlawful;
• present a DRAFT document, or an altered document, as an official Bean Proof document.

12. Ownership

• Your Data and your Reports belong to you. You give us permission to use them only to provide the Service to you.
• The Service belongs to us — the software, calculation rules, templates, design and the Bean Proof name. You get a right to use it while your subscription is active, not ownership.
• If you send us ideas or feedback, we may use them without obligation to you.

13. Confidentiality

Each of us will keep the other's confidential information private, use it only for this agreement, and protect it at least as carefully as our own. This does not cover information that is public (for example your published report), already known, independently developed, or that the law requires to be disclosed.

14. Data protection

For Your Data about employees, you are the controller and we are the processor. The Data Processing Terms in Schedule 1 form part of this agreement. How we use information about your Users is explained in our Privacy Policy.

15. Availability and support

• We aim for the Service to be available at least 99.5% of each month, excluding planned maintenance, which we will announce in advance and schedule outside Irish business hours where possible.
• We take extra care around the June snapshot and November publication periods and avoid planned maintenance in the final two weeks before the November deadline.
• Email support is included in all Plans, answered on Irish business days. Plus and Advisor Plans get priority support and an onboarding call.

16. Ending the agreement

• You can stop renewal at any time (see section 7), and can ask us to close your account at any time.
• Either of us can end the agreement by written notice if the other seriously breaks it and does not fix the problem within 30 days of being told, or becomes insolvent.
• We can suspend access straight away if needed to stop a security threat or unlawful use, and will tell you why.
• When it ends: download your Reports, PDF packs, Preparation Records and evidence before your account is closed, because closing ends every sign-in at once. We keep a closed account for 30 days and can reopen it in that time if you ask. After that we delete Your Data as set out in Schedule 1, except frozen data and the evidence record, which are kept for the periods in our Privacy Policy, and published report pages, which stay online as described in section 10.

17. Our promises, and their limits

We promise that:

• the Service will calculate the statutory figures in line with the calculation rules for the relevant reporting year, applied to the data as you confirmed it;
• if a figure is wrong because of a mistake in our calculation, we will correct it, produce a corrected Report and documents at no cost, and help you publish the correction.

Apart from what these terms say, the Service is provided as it is, and we do not promise it will meet every need you have or be free of every mistake.

18. Liability

• Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law does not allow to be limited.
• Neither of us is liable for loss of profit, revenue, business or goodwill, or for indirect or consequential loss.
• Each party's total liability in any 12-month period is limited to the fees you paid for the Service in the 12 months before the event.
• For breaches of section 13 (confidentiality) or Schedule 1 (data protection), that limit is instead [three times those fees, or €50,000, whichever is higher].
• We are not responsible for figures or statements that are wrong because of the data you provided or the decisions your Users made.

19. Things outside anyone's control

Neither of us is responsible for delays caused by events beyond reasonable control (for example a major cloud outage, a natural disaster or war). If such an event stops the Service for more than 30 days, either of us may end the agreement and you will receive a pro-rata refund for the unused time.

20. Changes to these terms

We may update these terms. For a change that matters, we will email you at least 30 days before it applies. If you do not agree, you can end the agreement before the change takes effect and receive a pro-rata refund for the unused time.

21. General

• Governing law: Ireland. Courts: the courts of Ireland.
• These terms, Schedule 1 and any order form make up the whole agreement. If an order form signed by both of us says something different, the order form wins.
• If any part of these terms cannot be enforced, the rest still applies.
• Neither of us may transfer this agreement without the other's consent, except to a buyer of all or most of a business, with notice.
• Notices go to the email address on your account and to legal@beanproof.com.
• Not enforcing a right straight away does not mean giving it up.

Schedule 1 — Data Processing Terms

These terms meet the requirements of Article 28 of the GDPR.

1. The processing

2. What we commit to

We will:

1. process Your Data only on your documented instructions — these terms, and what your Users do in the Service — and tell you if we think an instruction breaks data protection law;
2. make sure everyone who can access Your Data is bound by confidentiality;
3. apply the security measures in part 6 below;
4. use sub-processors only as set out in part 3;
5. help you answer requests from employees exercising their rights, and with data protection impact assessments, where you need information only we hold;
6. tell you without undue delay, and in any case within 48 hours, after we become aware of a security incident affecting Your Data within the meaning of Article 4(12) of the GDPR, with the information you need to meet your own obligations;
7. when your account is closed, delete Your Data from live systems 30 days after closing (the period in which it can be reopened) and from backups within a further 35 days, unless the law requires us to keep it; frozen snapshots, figures and the evidence record are kept until four years from the publish-by date (the three years the report must stay public, plus one) and then deleted; published report pages are kept as described in section 10 of the terms;
8. make available the information needed to show we meet these obligations, and allow audits as set out in part 5.

We will never use Your Data for our own purposes, including AI training, benchmarking or marketing.

3. Sub-processors

• You authorise the sub-processors listed in section 7 of our Privacy Policy.
• We will give you at least 30 days' notice before adding or replacing a sub-processor that handles employee data. If you object on reasonable data protection grounds and we cannot resolve it, you may end the agreement and receive a pro-rata refund.
• We will put terms in place with each sub-processor that protect Your Data at least as well as these, and we remain responsible for them.

4. Location and transfers

Your Data is stored and processed in the European Union. We will not transfer it outside the European Economic Area unless the transfer is covered by an adequacy decision or the European Commission's Standard Contractual Clauses, with any additional safeguards needed.

5. Audits

We will answer reasonable written security questions and share our most recent independent penetration test summary once a year. If that is not enough to show we meet these terms, you may carry out an audit, at your cost, with 30 days' notice, during business hours, no more than once a year (unless following a security incident affecting Your Data), and subject to confidentiality.

6. Security measures

• Encryption in transit (TLS 1.2 or higher) and at rest.
• Each customer's and each Employer's data isolated by database-enforced row-level security, with automated isolation tests on every software change.
• Frozen snapshots, figures and published reports cannot be altered; corrections create new versions.
• Tamper-evident evidence record of every change.
• Uploaded files and generated documents kept in each customer's own private storage, separate from every other customer's.
• Staff access limited to those who need it. Support access to your data is granted by you, for one Employer at a time, is time-limited, is shown to you and can be ended by you at any time; it is opened only by a named member of our staff signed in to our own staff system with multi-factor authentication, and is logged under their name.
• Secrets held in a managed key vault.
• Uploaded files scanned for malware.
• Daily backups, encrypted, kept in the EU.
• Logs and monitoring tools exclude employee-level data.
• Independent penetration test at least once a year, with tenant isolation as an explicit target.
• AI processing kept in the EU, with no training on customer data and no data shared between customers.