Terms of Service

Last updated: October 17, 2026

These Terms of Service ("Terms") are the agreement between you and Yousea Technology Limited for the use of RedRound, the website security testing service at https://redround.com. They set out what you must confirm before we test a website, what a report does and does not show, how plans and billing work, and the limits of our liability. Our Refund Policy forms part of these Terms, and our Privacy Policy and Cookie Policy explain how we handle personal data.

1. Who we are

RedRound is operated by Yousea Technology Limited, a company registered in Hong Kong. Our registered address is FLAT 03, 15/F CARNIVAL COMMERCIAL BUILDING, 18 JAVA ROAD, NORTH POINT, HONG KONG.

In these Terms, "RedRound", "we", "us" and "our" mean Yousea Technology Limited. "You" means the individual or organization that uses the service.

You can contact us at:

support@redround.com for questions about the service, accounts, billing and refunds, for legal notices, and to report suspected unauthorized testing traffic;
privacy@redround.com for privacy and data-protection requests.

2. Accepting these Terms

You accept these Terms when you create an account, start a Free test, place an order, start a subscription or approve a test plan. If you do not accept them, do not use the service.

To use RedRound:

you must be at least 18 years old;
you may act as an individual or on behalf of a business or other organization;
if you act on behalf of an organization, you confirm that you have authority to accept these Terms for it. The organization is then bound by these Terms, and "you" includes it;
you must not be located in, or ordinarily resident in, a country or region subject to comprehensive sanctions, and you must not be named on, or owned or controlled by a person named on, a sanctions list maintained by the United Nations, the United States, the European Union, the United Kingdom or Hong Kong.

3. Key terms

Website: one hostname. www.example.com and app.example.com are two websites.
Workspace: the part of an account that holds websites, ownership verification records, test plans, orders, subscriptions and reports, and the members who can access them.
Round: one security test of one website under an approved test plan, ending in a report.
Test plan: the conditions of a round that you approve: the test window, the request rate and the excluded paths.
Test window: the period in which testing for a round takes place.
Finding: a vulnerability confirmed in a round. Each finding has a severity: critical, high, medium, low or informational.
Report: the result of a round, delivered as a web page and a PDF. For a Free test, you first receive a summary (section 8.2).
Release: the time a report or summary becomes available in your workspace.

4. Accounts and workspaces

You sign in with an email address and password, or with Google sign-in.
Keep your account details accurate, in particular your email address. We send reports, reminders and notices to it.
Keep your sign-in details confidential. You are responsible for activity under your account. If you believe someone has used your account without permission, tell us promptly at support@redround.com.
Each person needs their own account. To work with others, invite them to your workspace instead of sharing sign-in details.
You can invite members to a workspace and assign them roles. You are responsible for the members you invite and for their actions in the workspace, including adding websites, approving test plans and placing orders.

5. Authorization to test

Security testing sends test traffic to a website. Testing a website without the permission of those entitled to give it may be unlawful. This section sets out what you confirm to us before any testing takes place.

5.1 Your warranty

Each time you add a website, approve a test plan or place an order, you warrant that:

you own the website, or you have written permission from its owner for RedRound to test it under the approved test plan;
if the website is hosted or delivered by a third party (for example a hosting provider, cloud platform or content delivery network) whose terms require permission for security testing, you have that permission;
the permission covers the whole scope of the round and remains valid until the round ends;
the testing you request does not breach any law or agreement that binds you.

If any of these statements stops being true, you must tell us at once and, where possible, cancel the round before its test window starts.

5.2 Ownership verification

Before we test a website, you must verify ownership of it with a DNS TXT record, a file on the website, or an HTML meta tag. A verified root domain covers its subdomains for ownership purposes. We check ownership again before every order. If ownership can no longer be confirmed, we do not start a round for that website.

Ownership verification is a technical check. It does not replace your warranty in section 5.1, and passing it does not show that every permission required under section 5.1 has been given.

5.3 Proof of authorization, refusal, pausing and stopping

We may ask you at any time for evidence of ownership or of written permission, including permission from a hosting provider. We may refuse a website or an order, or pause or stop testing at any time, including during a test window, if:

you do not provide the evidence we ask for;
we reasonably believe the testing may be unauthorized, may affect a third party, or may breach a hosting provider's terms;
we reasonably believe the testing is disrupting the website or other systems.

We will tell you when we do this, unless the law prevents us.

5.4 Websites on shared hosting platforms

We screen websites on shared hosting platforms before we accept an order. The terms of such a platform may forbid security testing, so we may refuse these websites.

5.5 Records of your approvals

When you verify ownership and approve a test plan, we record the approval, including the time, your IP address and the version of these Terms that applied. We keep these records with the order, as described in our Privacy Policy, and may use them to answer questions or claims about a round.

5.6 Reports of unauthorized testing

If you believe that RedRound test traffic has reached a website without permission, tell us at support@redround.com. We may pause testing of that website while we look into the report.

6. Test plans and how a round runs

6.1 The test plan

No round starts until you have approved its test plan. The test plan sets the test window, the request rate and any paths to exclude.
Testing takes place only within the approved test window, at no more than the approved request rate, and does not cover excluded paths.
Testing is performed by RedRound's internal security testing service. Findings are reviewed by security researchers before the report is released.
We never ask for or store login credentials for your website. Do not include passwords or other credentials in a test plan or send them to us.

6.2 Your responsibilities during a round

Security testing sends requests to your website. Even within an approved test plan, it may add load, create log entries or alerts, or disrupt the website or connected systems. You are responsible for:

keeping current backups of the website and its data before each test window;
monitoring the website during the test window;
setting a request rate the website can handle, and excluding paths you do not want tested, such as checkout or administration pages;
informing your hosting provider or other parties in advance where your arrangements with them require it.

To pause or stop testing during a round, contact support@redround.com. We will pause or stop testing as soon as reasonably possible.

Stop: the round ends, and we release a report covering what was tested before the stop. A Single report is then charged under the normal rule in section 8.3, and a subscription round counts as used.
Pause: we resume testing within the approved test window. If the window closes before testing resumes, the round ends as if you had asked us to stop.

6.3 Subscription rounds

Rounds for subscriptions are created automatically 48 hours before each cycle date, if ownership of the website is still verified and its test plan is complete. If not, we notify you, and no round runs and no report is issued for that website for that cycle.

6.4 Incomplete coverage

If the website is unreachable during the test window, or your exclusions block its main functions, the round may not cover the whole website. The report is still delivered under the normal rules of your plan, and a Free test round counts toward the Free test limits.
If coverage is incomplete for reasons on our side, we reschedule the round at no charge, and it does not count toward the Free test limits.

7. Reports

7.1 What a report contains

A report lists the findings confirmed in the round. Each finding states its location, severity, evidence and the steps to fix it, and is mapped to the OWASP Top 10 and CWE.
Severity ratings are assigned by RedRound.
The report, or for a Free test the summary, is released within 24 hours of the start of the test window. If we miss this for reasons on our side, the remedy in our Refund Policy applies.
We email you when a report is ready. The email links to the web report; the PDF is not attached.

7.2 What a report does not show

A report is a point-in-time result. It describes the website as it was during the test window, within the agreed scope and test conditions of that round. It does not cover later changes to the website, excluded paths or other hostnames.
No security testing can identify every vulnerability. We do not guarantee that a round will find all vulnerabilities in the website.
Fix steps are guidance. You decide how to apply them, and you should test changes before you deploy them.
When a round confirms no vulnerabilities, the report states: "Within the agreed scope and test conditions of this round, no vulnerabilities were confirmed." This statement does not mean that the website has no vulnerabilities, and you must not present it as meaning that.
A report is not a certification, an audit opinion or a confirmation of compliance with any law, regulation or standard. The OWASP Top 10 and CWE mappings classify findings; they do not certify compliance.

8. Plans, prices and billing

8.1 Plans

Plan	Price	What it includes
Free test	USD 0	One round on one website, with a summary (section 8.2)
Single report	USD 1,000 per report	The full report for one round on one website (section 8.3)
Basic	USD 1,000 per month or USD 4,999 per year	Up to 5 websites (section 8.4)
Pro	USD 1,500 per month or USD 8,000 per year	Up to 10 websites (section 8.4)
Enterprise	USD 3,000 per month or USD 15,000 per year	Up to 30 websites (section 8.4)

Current prices are shown on our pricing page. The price that applies to you is the one shown when you place an order or start a subscription.

8.2 Free test

A Free test is one round on one website.
After the round, you see a summary: the number of confirmed findings, their distribution by severity, the scope, the test date and the price of the full report.
If the round confirms no finding of medium or higher severity (only low or informational findings, or none), the full report is delivered free.
If the round confirms at least one finding of medium or higher severity, you can buy the full report under the Single report terms in section 8.3.
Limits: one Free test per website (hostname) every 180 days, and at most one Free test in progress per workspace.

8.3 Single report

A Single report is the full report for one round on one website, at USD 1,000 per report.
You are charged only if the round confirms at least one finding of medium, high or critical severity and you choose to buy the full report.
You can buy the full report within 27 days of the release of the round's results (the purchase window). We send reminders 7 days and 1 day before the purchase window closes.
If you do not buy within the purchase window, the full report can no longer be bought, and the round's results are deleted 30 days after release.
Payment unlocks the report of that round. It does not start a new round.
The price is fixed when the order is accepted and does not depend on the number of findings.
A website can have one round without charge every 180 days, whether the round was ordered as a Free test or as a Single report. If a website has already had a round without charge in the last 180 days, a new Single report round on it is charged at the Single report price, whatever its findings. We tell you this before you confirm the order.
If you disagree with a severity rating that decides whether a Single report is charged, email support@redround.com within 14 days of the release. A security researcher reviews the finding and replies in writing. If, after the review, no finding of medium severity or higher remains, the report is not charged, or your payment is refunded in full.

8.4 Subscriptions: Basic, Pro and Enterprise

A subscription covers up to the number of websites of its plan. Each website gets one round per billing month, with the full report every time. On yearly billing, this means one round per website in each month of the subscription year.
Each round retests the findings still open from earlier rounds.
Subscriptions are paid in advance, monthly or yearly.
Automatic renewal. A subscription renews automatically at the end of each period, for a period of the same length, until you cancel it. We charge your payment method at the start of each new period.
Cancellation. You can cancel at any time in your account, through the Stripe Customer Portal. Cancellation takes effect at the end of the paid period, and the subscription continues until then. No refunds or credits are given for the rest of the period (section 9).
Changing plans. A change to a plan with more websites, or from monthly to yearly billing, takes effect at once; we charge the difference for the rest of the current period on a pro rata basis. A change to a plan with fewer websites, or from yearly to monthly billing, takes effect at the end of the current period.

8.5 What counts as a website

A website is one hostname. www.example.com and app.example.com are two websites, even though a verified root domain covers both for ownership purposes.
On a subscription, each website slot can be switched to another verified website once every 30 days.

8.6 Payment, taxes and price changes

Prices are in US dollars and exclude taxes. Where VAT, GST or sales tax applies, it is calculated at checkout and added to the price.
Payments are processed by Stripe. Yousea Technology Limited is the seller; Stripe processes payments for us and is not the merchant of record. We do not store full card numbers.
You authorize us to charge your payment method, through Stripe, for each purchase and each subscription renewal.
If a payment fails, we may suspend the related subscription or paid features until it is paid, and end the subscription if it remains unpaid after we have notified you.
We may change our prices. For subscriptions, we will notify you at least 30 days before a new price applies, and it applies from your first renewal after that notice period. If you do not accept the new price, you can cancel before that renewal. The price of a Single report is fixed when the order is accepted.

9. Refunds

Our Refund Policy sets out the full rules. In summary:

Subscriptions continue to the end of the paid period after cancellation; the rest of a monthly or yearly period is not refunded or credited.
A round canceled before its test window starts is not charged, or is refunded or credited if already paid.
If a report is late for reasons on our side, you choose a full refund of that report or round, or a free new round.
A delivered paid report is not refunded, except for late delivery on our side, billing errors reported within 30 days of the charge, or where the law requires.

10. Acceptable use

You must not:

add, verify or request testing of a website that you are not authorized to have tested, or give false information to pass ownership verification;
use a test plan to ask us to test anything outside your authority, such as systems belonging to third parties;
resell or redistribute reports, or offer them as part of your own security testing service, without our written agreement;
interfere with or disrupt the service, try to access accounts, workspaces or data that are not yours, or try to get around limits or access controls;
carry out security testing of the RedRound service itself without our written agreement;
create several accounts or workspaces, or use other people's accounts, to get more Free tests than the limits allow;
copy, decompile or reverse engineer the service, except where the law allows it;
use the service or any report in breach of applicable law, or to harm a website owner, its users or any other person.

If you break these rules, we may act under section 14, and section 17 may apply.

11. Your content, confidentiality and retention

11.1 Your content

You keep all rights in your websites and their data. "Your content" means the information you give us and the data obtained from your website during a round, including hostnames, test plans, findings, evidence and reports. You allow us to use your content to provide the service, including to test the website under the approved test plan and to prepare, store and deliver reports.

Evidence such as HTTP requests and responses and screenshots may include personal data of your website's users. For that personal data, you are the controller and we act as your processor. A Data Processing Addendum is available on request at privacy@redround.com. Our Privacy Policy explains how we handle personal data.

11.2 Confidentiality

We treat your reports, findings and evidence as confidential. We use them only to provide the service, and we disclose them only to service providers who need them to provide the service and are bound by confidentiality obligations, or where the law requires. You decide who you share your reports with, and you are responsible for keeping downloaded copies confidential.

We may create de-identified, aggregated statistics from the use of the service, such as the number of rounds or the distribution of finding types. These statistics do not identify you, your websites or your users. We may use them to operate and improve the service and to describe general trends.

11.3 Retention

Free test summary: 30 days from release.
Full report delivered free after a Free test: 30 days from release.
Single report results that are not bought: deleted 30 days after release.
Purchased Single report: 12 months from release.
Subscription reports: kept while the subscription is active; after cancellation, available for export for 30 days, then deleted.
Deleted data may remain in backups for up to 90 days.
Billing records are kept as required by tax and accounting law.

Download any report you want to keep before its retention period ends. Our Privacy Policy gives more detail.

12. Intellectual property

The service, our software, report formats and templates, our website content and the RedRound name and logo belong to us or our licensors. These Terms do not transfer any of them to you.
Subject to these Terms and to payment of any fees due, you may use, copy and share the reports and summaries you receive for your own purposes, including fixing your websites and showing results to your customers, auditors, insurers and advisors.
You must not remove RedRound's name from a report, present a report as prepared by someone else, or use the RedRound name or logo to suggest that we endorse or certify your website.
If you send us feedback or suggestions, we may use them without any obligation to you.

13. Third-party services

Stripe processes payments and subscription management through Stripe Checkout and the Stripe Customer Portal. Stripe's own terms and privacy policy apply to your use of those pages.
Google sign-in is optional. If you use it, Google's terms and privacy policy also apply.
We are not responsible for third-party services that we do not control, including the hosting, platform and network providers your website relies on.

14. Suspension and termination

14.1 By you

You can cancel a subscription at any time (section 8.4) and stop using the service at any time. To close your account, write to support@redround.com.

14.2 By us

We may suspend or end your access to the service or any part of it, including by stopping a round, if:

you breach these Terms in a material way, including section 5 or section 10;
a payment is overdue, or you open a chargeback (see our Refund Policy);
ownership verification for a website lapses or can no longer be confirmed, in which case we may suspend testing of that website only;
we reasonably suspect misuse, such as unauthorized testing, false ownership verification, or the use of several accounts to get around the Free test limits;
the law, a court or a regulator requires it.

Where we can, we tell you the reason and give you the chance to fix the problem, and we lift a suspension once the problem is fixed.

If a round is stopped because your warranty in section 5.1 was not true, or because you breached section 10, you are not entitled to a refund for that round. If we end a subscription for a reason other than your breach of these Terms, we refund the unused part of any prepaid period.

14.3 After termination

After your account or subscription ends, we keep and delete your data as described in section 11.3 and in our Privacy Policy. Sections 5, 11, 12, 15, 16, 17, 19 and 20, and any payment obligations already due, continue to apply.

15. Disclaimers

We provide the service with reasonable care and skill. Apart from that and the commitments expressly stated in these Terms, and to the extent permitted by law:

the service and reports are provided "as is" and "as available";
we do not warrant that the service will be uninterrupted or free from errors, that a round will find every vulnerability, or that fix steps are complete or will prevent future incidents;
we do not warrant that testing will have no effect on your website or connected systems (section 6.2);
we exclude all other warranties, conditions and terms, express or implied, including those of fitness for a particular purpose.

Nothing in these Terms affects rights you have as a consumer that cannot be excluded or limited by law.

16. Limitation of liability

16.1 Liability we do not limit

Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded by law.

16.2 Losses we are not liable for

Subject to section 16.1, we are not liable, whether in contract, tort (including negligence) or otherwise, for:

loss of profits, revenue, business, goodwill or anticipated savings;
loss or corruption of data that you could have avoided by keeping backups as required by section 6.2;
indirect or consequential loss.

16.3 Overall limit

Subject to section 16.1, our total liability arising out of or in connection with these Terms and the service is limited to the fees you paid us in the 12 months before the claim arose. If you have paid us nothing, for example because you have used only Free tests, our total liability is limited to USD 100.

16.4 Consumers in the EEA, the UK and Switzerland

If you are a consumer resident in the European Economic Area (EEA), the United Kingdom or Switzerland, we are responsible for loss you suffer that is a foreseeable result of our breach of these Terms or our failure to use reasonable care and skill. Sections 16.2 and 16.3 apply to you only to the extent that the mandatory law of your country of residence allows.

17. Indemnity

To the extent permitted by law, you will indemnify Yousea Technology Limited and its officers, employees and contractors against all claims, losses, fines, penalties, damages and reasonable costs (including legal fees) arising from:

testing of a website that you were not authorized to have tested, or any breach of your warranty in section 5.1;
any breach of a third party's terms, including a hosting provider's terms, in connection with testing you requested.

We will notify you promptly of any such claim and cooperate reasonably with you in its defense. If you are a consumer, this section applies only to the extent that the law of your country of residence allows.

18. Changes to these Terms

We may update these Terms, for example to reflect changes to the service or to the law. We publish the updated version on this page with a new "Last updated" date.
For material changes, we notify you by email or in your account at least 30 days before they take effect.
A round whose test plan you approved before a change takes effect, and a Single report order accepted before then, remain under the version of the Terms that applied when you approved or ordered it.
If you do not accept a change, stop using the service and cancel any subscription before the change takes effect. If you continue to use the service after that, the updated Terms apply.
Price changes follow section 8.6.

19. Governing law and disputes

These Terms, and any dispute arising from them or from the service, are governed by the laws of Hong Kong.
The courts of Hong Kong have exclusive jurisdiction over any such dispute, except as set out in the next point. We may also apply to any competent court for urgent relief to stop unauthorized testing or misuse of the service.
If you are a consumer resident in the EEA, the United Kingdom or Switzerland, you keep the protection of the mandatory laws of your country of residence, and you may bring proceedings in the courts of your country of residence.
Before starting proceedings, please contact support@redround.com so that we can try to resolve the matter.

20. General

Entire agreement. These Terms, the Refund Policy, and the orders and test plans you approve form the entire agreement between you and us about the service, and replace any earlier arrangements on the same subject.
Assignment. You may not transfer your rights or obligations under these Terms without our written consent. We may transfer ours to another company in our group or to a buyer of the service or of our business, provided your rights under these Terms are not reduced.
Severability. If a court finds any part of these Terms invalid or unenforceable, the rest remains in force.
No waiver. If we do not enforce a right, or delay in enforcing it, we do not give up that right.
Third-party rights. No one other than you and us has any right to enforce these Terms.
Language. These Terms are written in English. We may provide translations for convenience. If a translation differs from the English version, the English version prevails.
Notices. We send notices to the email address of your account or show them in your account. Send notices to us at support@redround.com.

21. Contact

Company: Yousea Technology Limited, operator of RedRound
Registered address: FLAT 03, 15/F CARNIVAL COMMERCIAL BUILDING, 18 JAVA ROAD, NORTH POINT, HONG KONG
Service, billing, refunds and legal notices: support@redround.com
Privacy and data protection: privacy@redround.com