Audit · $490

Legal · Terms

Updated 22 Oct 2026

Terms of service

These terms apply to every audit, fix, sprint, care plan and build I deliver under the name badii.studio. "I" and "me" means Badii Boutar, trading as badii.studio, registered in Tunisia (tax ID 1885957Y/A/P/000), 015, Zone Stade IM JARDI, 5000 Monastir, Tunisia. "You" means the person or company that buys the work. Buying an offer or accepting a quote means you accept these terms.

1. Scope

Each engagement is defined by an order: the offer page you buy from, a written quote, or an email we both agree to. The order sets the scope, price and timeline. Anything outside it is new work and needs a new quote. Changes to scope are agreed in writing, email is enough.

2. Prices and payment

  • Audits: 100% upfront
  • Sprints: 50% to start, 50% at launch
  • Care: billed monthly in advance
  • MVPs: 30% / 40% / 30%

Prices exclude VAT. VAT is added where the law requires it, and the reverse charge applies to business clients where it is available. Invoices are in USD unless we agree on EUR. MVP milestones for the 30% / 40% / 30% split are set in the quote.

Payments are processed via Stripe by my billing partner Pan African Center for Entrepreneurship, Korte Bogaardstraat 8, 2011 WT Haarlem, Netherlands. Your card statement shows WITHPACE.ORG.

Invoices that are not paid upfront are due within 14 days. If an invoice is unpaid when due, I pause work until it is paid, and deadlines move by the length of the pause. No late fee is charged.

The Launch Audit fee is credited 100% toward a Fix & Launch Sprint booked within 14 days of the audit report.

3. Refunds and the audit guarantee

If the audit doesn't find at least 5 concrete, actionable issues, it's free. In that case I refund the audit fee in full. All other refunds follow the refund policy, which is part of these terms.

4. Audit disclaimer

An audit is a point-in-time review of provided code and configuration, not a penetration test, certification or guarantee of security.

I review what you give me access to, as it is on the day of the review. Code, settings, dependencies and third-party services change after that. Finding no issue in an area does not mean the area has no issues.

5. Your part

  • Give me the access the order needs, starting with read-only access.
  • Answer questions in reasonable time. Timelines assume you do.
  • Keep ownership of your accounts (GitHub, hosting, database, Stripe) and your own backups.
  • Make sure you have the right to share the code and data you give me.

6. Intellectual property

When an invoice is paid in full, I assign to you all rights in the code, documents and other deliverables paid for by that invoice. Until then, you may use them to evaluate the work.

I keep my general know-how and any tools or snippets I made before or outside the engagement. Where any of these end up in your deliverables, you get a permanent, free licence to use and change them as part of your product. Open-source code stays under its own licence.

7. Confidentiality

Both of us keep the other's confidential information private and use it only for the engagement. This covers code, data, credentials, business plans and the contents of audit reports. It does not cover information that is already public or that the other party already had. This duty continues after the engagement ends. I sign a separate NDA on request.

When the engagement ends, I remove my access and delete copies of your code and data within 30 days, unless you are on a Care plan or ask me to keep them.

8. Data processing

Your app may hold personal data, such as your users' records. For that data you are the controller and I am the processor under the GDPR (Article 28). This section is our data processing agreement.

  • I process personal data only on your instructions and only to deliver the work you ordered.
  • I keep it confidential and use read-only access wherever the work allows.
  • I protect it with appropriate security: access limited to me, two-factor authentication on my accounts, and no copies of production data unless the work needs them.
  • By default, I use the tools the work needs, including AI models: GitHub (code hosting), Gmail (email), Loom (screen recordings) and Anthropic's Claude Code (AI coding assistance). I tell you before adding a new one.
  • If you don't want me to use a tool, tell me in writing and I won't use it on your work. AI models run with training on your data turned off.
  • I help you answer your users' requests to see, correct or delete their data.
  • If personal data I handle is exposed, I tell you without undue delay, with what I know and what I am doing about it.
  • When the work ends, I delete the data within 30 days, as described above.
  • On request, I give you the information you need to show this processing complies with the GDPR.

9. Warranty

I do the work with professional skill and care. Apart from that, the work is provided as is. I do not promise that your app will be free of bugs or security issues, or that it will reach any business result.

10. Liability

My total liability for any claim connected to an engagement is capped at the fees you paid me for that engagement. Neither of us is liable for indirect or consequential losses, such as lost profit, lost revenue or lost data. These limits do not apply where the law does not allow them to.

11. Ending an engagement

Either of us can end an engagement with written notice. You pay for work done up to that point, I hand over what is finished, and any refund follows the refund policy. Care plans can be cancelled at any time and end at the close of the month already paid.

12. Law and disputes

These terms are governed by Dutch law. Any dispute goes to the competent court in Amsterdam, the Netherlands. Before that, we both try to settle it by email in good faith.

13. Contact

Questions about these terms: badii@badii.studio.