Terms of service
1. Parties and definitions
We are The Thrivee LLC, a Wyoming limited liability company ("Thrivee"). Mailing address: 1007 N Orange St. 4th Floor, 2991, Wilmington, DE 19801, USA. Email: [email protected]. You are the business that places an order or accepts an offer from us.
These terms cover the Website Security Patch (clauses 2 to 11) and our growth work for DTC and ecommerce brands. Growth work starts only after you accept a written offer that sets out the scope, price, currency, billing schedule and start date; where an offer and these terms disagree, the offer wins. The growth audit you request on this site is free and commits you to nothing.
Fixed build: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer within the same branch, or a distribution or panel package (or the PHP security team's official backport for 7.4, 8.0 and 8.1) whose changelog names CVE-2026-109618 and CVE-2026-109619. Working access: we can log in with the agreed method and your written authorisation naming the host is on file. Site: one website or domain; three stores on one server are three sites. Server: the machine, VPS or hosting account a site runs on. Version line: the PHP version line you already run; 8.3.x stays 8.3.x. Report: our written report for each server your sites run on, sent when the work is done.
2. The Website Security Patch
The Website Security Patch service is the PHP security patch, to a fixed build on the PHP version line you already run, on the server each site you order runs on. On shared or managed hosting we switch the website to the host's patched PHP in your panel, or open and follow the ticket with your host, with the same 24-hour promise.
What we do, per site
- The PHP security patch, on the PHP version line you already run, on the server each site you order runs on (for example 8.1.x → a patched 8.1.x).
- Restart of the PHP services.
- Verification on a live request.
- A written report, with our access removed.
What we don't do
- Change your website code, plugins, themes, database or content.
- Move you to a newer PHP version: that is a separate custom job. We quote it first and bill it hourly.
- Fix existing bugs or errors.
- Clean malware or investigate past attacks (already hacked? tell us what's happening).
- Guarantee against future attacks or other vulnerabilities.
- Manage your hosting.
You keep your own backups. After a verified patch with the report delivered, the service for that site is complete (except where the law says otherwise). Terms
Complex setups. The price covers the security patch on the version line you already run. Moving to a newer PHP version is a separate custom job. We quote it first and bill it hourly. Complex or enterprise setups, such as clusters, containers or Kubernetes, custom-compiled PHP, several servers that depend on each other, strict change-control processes or unusual hosting, are quoted case by case before we start; if you don't accept the quote, we refund your payment in full.
Complications during the work. If complications come up during the work that go beyond the security patch, we may charge for the extra work at our hourly rate of US$120, or we may choose not to charge for it. Before any extra charge we explain the reason and give you an estimate, and we go ahead only with your written agreement (email is fine). Without it we stop, and the Patched-or-Refunded Promise in clause 7 applies to the work as ordered.
3. Eligibility
The Website Security Patch is for business customers only, not for personal or household use. A consumer order that slips through is refunded on request without argument. You confirm that you own the systems you name or are authorised by their owner, and that the access you give is permitted under your hosting provider's terms.
4. Ordering, price, tax and start date
By pressing Pay on the order page you agree to these terms and confirm you're buying for a business; we keep a record of that (terms version, time, shortened IP address, browser) with your order. The price is per site, in the currency shown on the order page, prepaid by card through Stripe (with 3-D Secure where your bank asks for it). We never ask for card details by email or phone; invoices for growth work can also be paid by bank transfer.
This is the total. We charge no sales tax, VAT or GST; UK and EU VAT-registered businesses account for VAT under the reverse charge (Art. 196 Directive 2006/112/EC / UK reverse charge). Business customers only.
If the order page or your invoice shows a start date, work starts on that day and the 24 hours in clause 7 count from working access on or after it. Otherwise we start as soon as we have working access.
5. Access you give us
Pressing Pay gives the authorisation, recorded the same way as your acceptance (orders placed before that give it on the access call); we start only once you have. Then you give us access in one of four ways: invite [email protected] to your hosting account as a team member, do it together with us on a 10-minute call, add our SSH public key to a temporary user, or send a temporary login as a one-time link. You give access within 7 days of payment; otherwise we refund and close the order. We connect from a published address, use individual keys per engineer, keep session logs, and delete our access at hand-over; the report confirms it.
6. Credentials and access
A one-time link you send us must come from a self-destructing link service we list on the form. We store it encrypted; only the account owner, an admin and the manager assigned to your order can open it, and every opening is logged. It is never emailed and never added to dispute records. We delete it when our access is removed, when the report is sent or the order is refunded, or the same day you ask us by email, and after 7 days at the latest. We keep no copy of any credential and no copy of your data.
7. Performance and the Patched-or-Refunded Promise
The Patched-or-Refunded Promise is the box below. "Done" means the server a site runs on runs a fixed build; on shared or managed hosting the panel switch or the host ticket is our work, and if neither fixes it in time you get back what you paid for that website.
- Not done within 24 hours of working access? You get back what you paid for that site, automatically, even if we finish later. If you ask us to wait, the clock waits too.
- We check before we touch anything. Your host already fixed it, or we can't do it safely? You get your money back the same day, with the reason in writing.
Acceptance. The patch is delivered and accepted when we send you the written report.
30 days of priority support. The patch changes only the engine your website runs on, not the website itself: your pages, plugins, theme, content and data stay as they are. For 30 days after the patch, reply and we'll put you first. Any work after the patch, including finding out what caused a problem, is billed hourly. Our rate is US$120 an hour. We tell you the estimate first and start only with your OK (email is fine).
8. Refunds
Each site on an order is judged on its own. Money back means the amount you paid for that site, to the original card, within 14 days (credit toward a later order only if you ask for it). "Can't be done" includes: no fix exists for your version, your operating system has no package, custom-compiled PHP when you don't accept our quote (clause 2), or your host had already patched. After a verified patch with the report delivered, the service for that site is complete and not refundable, except where the law says otherwise.
Growth work: you can stop a recurring engagement at any time by emailing us; it ends at the close of the period already paid for, and no later invoices are sent. Work already delivered is not refundable. If you paid for a period we did not start, we refund it in full to the original payment method within 14 days.
If you think something went wrong, email [email protected] first, and we refund under these rules. We keep the order records (your acceptance, your authorisation, your answers, our session log references, the report and our emails) to answer card disputes.
9. What we do not do
Besides the list in clause 2: under the Website Security Patch we don't switch PHP versions, upgrade the operating system, move the site or clean malware (already hacked? tell us what's happening). We share past growth results as examples; every store is different, so we do not guarantee a specific revenue or profit outcome.
10. Purchases by agents
An AI agent or other software may place an order for a business. The business is the customer, and the agent confirms it has the business's authority to buy. Work starts only after a person who holds the hosting login gives access as clause 5 describes; we don't accept access from an agent, and an order that never gets that access is refunded under clause 5.
11. Your obligations
You confirm the systems hold no protected health information or raw cardholder data; we do not sign BAAs (contact us first if they do). You keep your own backups. You tell us about anything on the servers we should not touch, and you don't change the servers while we work on them.
12. Warranties and liability
Our total liability for a Website Security Patch order is capped at the fee paid for the affected site; for growth work, at the fees you paid us for it in the three months before the claim. We are not responsible for problems that existed before we started, changes by third parties (your host, plugin or theme vendors), changes made by anyone after hand-over, or later attacks; we don't guarantee against future attacks or other vulnerabilities. Nothing limits liability for death or personal injury caused by negligence, for fraud, or for anything the law (including the UK Unfair Contract Terms Act 1977 and consumer law) makes non-excludable. If we find signs of compromise we tell you in writing within 24 hours; notifying your regulator or customers is your decision as controller.
Nothing in these terms limits rights under the Australian Consumer Law (s67 of the Competition and Consumer Act 2010). For services not ordinarily acquired for personal use, our liability for a failure to comply with a guarantee is limited to supplying the service again or paying the cost of having it supplied again (s64A).
Our services come with guarantees that cannot be excluded under the Australian Consumer Law. For major failures with the service, you are entitled: to cancel your service contract with us; and to a refund for the unused portion, or to compensation for its reduced value. You are also entitled to be compensated for any other reasonably foreseeable loss or damage. If the failure does not amount to a major failure, you are entitled to have problems with the service rectified in a reasonable time and, if this is not done, to cancel your contract and obtain a refund for the unused portion of the contract.
The benefits of The Patched-or-Refunded Promise are in addition to your rights under the Australian Consumer Law. Warrantor: The Thrivee LLC, 1007 N Orange St. 4th Floor, 2991, Wilmington, DE 19801, USA, [email protected]. To claim, email us with your order number within 30 days of the report; we refund within 14 days to your card. Claiming costs you nothing.
13. Data protection
How we handle your own details is in our privacy notice. For the data on your servers we are your processor (UK GDPR and EU GDPR Art. 28(3)). Subject matter and duration: the security patch on the servers you name, until hand-over. Data and people: whatever is on your server (your customers, staff and users); we access it only to apply the security patch and keep no copy. We act only on your documented instructions; everyone who works on your server is bound to confidentiality. Security: individual keys per engineer, one-time links for secrets, session logs, a published address we connect from, access deleted at hand-over, no credentials kept. Sub-processors: our engineers and contractors, who may be outside the UK and EEA, bound by the same terms. We help with data-subject requests and give written notice within 24 hours of signs of compromise. At the end we return or delete everything. You may ask for the information needed to show compliance.
Transfers: The Thrivee LLC is in the US, and our engineers and contractors may be outside the UK and EEA. The EU Standard Contractual Clauses are incorporated by reference (Module 2 where you are the controller, Module 3 where you act as processor for your own clients), with the UK Addendum for UK customers.
14. Communication and unsubscribing
We email you from [email protected]. Emails about an order you placed (access, progress, the report) are part of the service. Anything else, such as news of the next PHP security fix or our notes on store growth, is sent only if you said "Yes, keep me posted". To stop it, reply "stop" or write to [email protected].
15. Governing law, changes and versions
These terms are governed by the laws of the State of Wyoming, USA. Nothing in them limits rights that consumer law, including the Australian Consumer Law and UK law, does not allow to be limited. When we change these terms we publish a new version here with its date. Each order is governed by the version you accepted, which we store with it (version 2026-10-25.6 today). Questions: [email protected] or the contact form.