Terms of Service

Winch Labs FZ-LLC
Registered address: HD18B, First Floor, in5 Tech, Dubai Internet City, King Salman Bin Abdulaziz Al Saud Street, Al Sufouh 2, Dubai, United Arab Emirates.
Licensed by Dubai Development Authority.

Last updated: 3 October 2026 · v1.1. These terms govern winchlabs.io and the Deltz service operated by Winch Labs FZ-LLC ("Winchlabs", "we"), a company licensed in the in5 / Dubai Development Authority free zone in Dubai, United Arab Emirates. If your organisation has a signed agreement with us (an enterprise, evaluation, or design-partner agreement), that agreement controls where it differs from these terms.

1. The service

Deltz reviews infrastructure-as-code changes in repositories you connect: it parses your code into facts, derives your repository's own conventions, checks pull requests against those conventions and built-in rules, estimates cost impact, records governance receipts, and can draft fixes and new configuration for your review. It is provided through a Git-provider app, a web application, a CLI/CI gate, and an MCP server.

What Deltz deliberately does not do: it never applies changes to your infrastructure, never executes your infrastructure code, and never receives your cloud credentials or state files. Fixes are committed to a branch and generated configuration is opened as a pull request; a human in your organisation merges, or nothing happens. These are architectural properties of the product, and these terms do not change them.

2. Findings are assistance, not assurance

Deltz is a review aid. Its checks are deterministic and deliberately conservative: when a value cannot be established from your code, Deltz stays silent rather than guessing, which means it under-reports by design. A review with no findings means Deltz found nothing to say — it is not a representation that your change is secure, compliant, correct, or free of cost impact, and Deltz is not a substitute for your own review, testing, and judgment. Cost estimates are order-of-magnitude figures from a static price table, not billing predictions. Compliance tags on findings indicate which control a finding is evidence toward; they are not a certification of you or of us. You remain solely responsible for your infrastructure and for every change you merge.

3. Accounts and organisations

You must provide accurate account information and keep credentials confidential. An organisation's owners and admins control its membership, settings, connected repositories, policies and overrides, and are responsible for actions taken under their organisation. Seats are for individual named users. You must have authority to connect any repository you connect.

4. Your content

Your code and data remain yours. You grant Winchlabs the limited rights needed to operate the service: to access connected repositories through the permissions you grant our Git-provider app, to process repository content to produce reviews, and to store the derived records the product exists to keep — findings with file-and-line evidence (including short code excerpts), context documents, receipts, episodes, and audit entries — for your organisation. We do not train machine-learning models on your content. Disconnecting a repository stops new processing; deletion of stored records is described in the Privacy Policy.

5. AI-assisted features

Fix and Forge use a large language model (Anthropic's Claude) to draft changes; the relevant file content and your repository's conventions are sent to the model provider to generate the draft. Every AI-drafted change passes the same deterministic gate as an external pull request before it can be pushed, and nothing merges without a human. On the Starter tier you supply your own Anthropic API key and your agreement with Anthropic governs that processing; on paid tiers using our keys, Anthropic acts as our subprocessor (see the DPA). AI output can be wrong; review it as you would a colleague's draft — the gate exists precisely because generated code is not exempt from review.

6. Plans, billing, and early access

Plans and prices are listed at /pricing. During early access, invoicing may be handled manually and early-access rates we have committed in writing are honoured for as long as the subscription remains active. Fees are exclusive of taxes; you are responsible for applicable taxes other than taxes on our income. Except where required by law, fees are non-refundable. Usage limits per tier are stated on the pricing page; we may adjust free-tier limits with notice. Deltz is early-access software: features change quickly, the changelog is the record, and no service-level agreement applies outside an enterprise agreement that states one.

7. Self-hosted deployments

Self-hosted Deltz is provided under the licence terms accompanying the software. You operate it: you are responsible for its environment, updates, and the data it processes. Self-hosted deployments make no calls back to Winchlabs — no telemetry, no licence check — so these terms' service provisions apply to self-host only where an enterprise agreement says so.

8. Acceptable use

Use of the service is subject to the Acceptable Use Policy, which is part of these terms.

9. Our intellectual property

The service, its software, catalog, documentation, and branding are owned by Winchlabs or its licensors. Rule-catalog entries cite identifiers from third-party open-source projects as attribution and cross-reference; see Licences & attribution. If you send us feedback, we may use it without obligation.

10. Confidentiality and security

Each party will protect the other's non-public information with at least reasonable care and use it only to perform under these terms. Our security posture — what we can and cannot access, encryption, isolation, audit — is described at /security and in the DPA. We will notify affected customers of a personal-data breach without undue delay.

11. Disclaimer of warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE MAXIMUM EXTENT PERMITTED BY LAW, WINCH LABS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICE WILL IDENTIFY ANY OR ALL DEFECTS, VULNERABILITIES, MISCONFIGURATIONS, POLICY VIOLATIONS, OR COST IMPACTS IN YOUR CODE OR INFRASTRUCTURE, OR THAT AI-GENERATED OUTPUT WILL BE ACCURATE OR FIT FOR USE.

12. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW: (a) NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR GOODWILL; AND (b) EACH PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE IS LIMITED TO THE FEES YOU PAID US FOR THE SERVICE IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY, OR USD 100 IF YOU HAVE PAID NONE. These limits do not apply to a party's infringement of the other's intellectual property, breach of confidentiality, your payment obligations, or liability that cannot be limited under applicable law.

13. Indemnity

You will defend and indemnify Winchlabs against third-party claims arising from your content, your infrastructure, or your breach of these terms. Winchlabs will defend and indemnify you against third-party claims that the unmodified hosted service directly infringes their intellectual-property rights, and may modify, replace, or refund to resolve such a claim; this is your exclusive remedy for service infringement.

14. Suspension and termination

Either party may terminate for material breach not cured within 30 days of notice. We may suspend access immediately where required to protect the service, other customers, or by law, or for non-payment after notice. You may stop using the service and disconnect repositories at any time. On termination, export tooling (audit CSV, evidence bundles, the read-only API) remains available for 30 days, after which the deletion terms of the Privacy Policy apply.

15. Governing law and disputes

These terms are governed by the federal law of the United Arab Emirates as applied in the Emirate of Dubai, and disputes go to the exclusive jurisdiction of the Dubai Courts. Winch Labs FZ-LLC is licensed in a Dubai Development Authority free zone (in5), which has no separate court of its own — so this is the forum the licence already implies, not an election we made. This forum applies to agreements entered from 17 October 2026; for accounts that existed before then it takes effect on that date, which is the 14 days’ notice §16 promises, and until then the forum you accepted continues to apply. But first, tell us the problem: most issues are resolved by writing to hello@winchlabs.io. Nothing in this section deprives you of mandatory protections of the law of the place where you reside.

16. Changes and the rest

We may update these terms; material changes are announced on the changelog and, for account holders, by email, at least 14 days before taking effect. Continued use after the effective date is acceptance. You may not assign these terms without our consent except to an affiliate or in a merger or asset sale; we may assign to an affiliate or successor. Neither party is liable for delay caused by events beyond reasonable control. If a provision is unenforceable, the remainder stands. You will comply with applicable export-control and sanctions laws. These terms plus the policies they reference are the entire agreement for the service.

17. Contact

Winch Labs FZ-LLC ("Winchlabs", "we"), Dubai, United Arab Emirates · hello@winchlabs.io (mark legal matters "Legal" in the subject line).