Terms of Service (draft)

AngelLink is a closed messaging service for youth organizations. Adults who work or volunteer with young people use it to talk to those young people, and the organization’s own leaders can see those conversations.

It is not a public social network. You cannot find strangers on it, and strangers cannot find you. Every account exists because an organization put it there.

The service is operated by [Company legal name], of [Registered address], company number [Company registration number]. In this document “we” and “us” mean that company, and “you” means the person reading it.

You may use AngelLink only if an organization has invited you and approved your account. There is no open sign-up. If your invitation is withdrawn, or the organization removes you, your access ends.

• Adults — staff, volunteers, leaders and supervisors — must be at least [Minimum adult age — to be confirmed] and must have completed whatever vetting their organization requires. We do not carry out that vetting; the organization does.
• Young people may use the service once their organization has enrolled them and any consent the law requires has been recorded. Where a guardian’s consent is needed, participation stays blocked until that consent exists.
• Guardians may be given view-only access, if their organization switches that on.

The age at which a young person can agree on their own behalf differs by country and by province. Each organization sets its own threshold, within the floor set for its jurisdiction: [Consent age threshold — to be confirmed by counsel].

If we cannot tell how old someone is, we treat them as a young person and require consent. We would rather block a legitimate account than let an unverified one through.

This distinction matters more than any other in this document, so it is worth reading twice.

• Your organization decides who joins, who supervises whom, what the chat hours are, who may see which conversations, and when someone is removed. It is responsible for how it runs its own safeguarding.
• We build and run the software those decisions are carried out in. We are not a party to the relationship between you and your organization.

So if you disagree with a decision about your account — who can read your messages, why you were suspended, what your chat hours are — the person to raise it with is your organization, not us. We generally cannot overrule them, and in most cases we should not.

Some settings are the exception, and your organization cannot change them. An organization cannot switch off its own oversight, its own consent requirement, or its own audit trail. Those are set by us for everyone, so that no organization can quietly reduce the protection its young people have.

Your account is yours alone. Do not share your password, and do not let anyone else send messages as you — every message and every action is recorded against the account that did it, and a shared account makes that record a lie.

Tell your organization straight away if you think someone else has got into your account. Keep your contact details accurate, because that is how we reach you if something goes wrong.

This is the point of the service, not a side effect of it, so it is stated here rather than buried in the privacy policy.

There are no private conversations on AngelLink. Approved leaders in your organization can read any conversation between an adult and a young person, including yours, without asking you first.

Specifically:

• Conversations are visible to the leaders your organization has approved.
• Messages cannot be edited once sent. What was sent is what stays on the record.
• Deleting a message hides it from the conversation. It does not erase it. Deleted messages are kept for leader review for [Deleted-message retention period — to be confirmed].
• Every conversation has an audit trail recording what happened in it and when.
• Messages are scanned automatically for signs of harm. See automatic safeguards.

If you want a private conversation, this is the wrong service. That is a deliberate design choice: hidden communication between an adult and a child is the exact risk this product exists to remove.

Do not use AngelLink to:

• Harm, groom, exploit, threaten, bully or sexually approach anyone — above all a young person.
• Send sexual images, violent images, or anything unlawful. Attachments are screened, and screening is not the same as permission.
• Move a conversation with a young person off this service in order to avoid being seen. Asking a young person for their personal phone number, or to continue on another app, defeats every safeguard here and will be treated seriously.
• Pretend to be someone else, or use an account that is not yours.
• Try to get around the chat hours, the moderation, the audit trail or the alerting — or to reach data belonging to another organization.
• Share what you read here outside the organization. Conversations involving young people are confidential, and a leader’s ability to read them is for safeguarding, not for gossip.

If you believe a young person is at risk, tell your organization’s safeguarding lead. If someone is in immediate danger, contact your local emergency services. AngelLink is not an emergency service and nobody is watching it around the clock.

Some protections run on their own, with no person deciding to switch them on for your conversation. You should know they are there.

• Scanning. Messages are checked automatically for six things: a request to keep the conversation secret, a suggestion to move to another app, an exchange of contact details, arranging to meet away from the organization’s activities, a request for photographs, and language suggesting risk of self-harm. The checking runs on our own servers — nothing is sent to another company. When something is flagged, a supervisor is notified and can open the conversation and its audit trail.
• Moderation. Text is filtered for abusive language and images are screened before they arrive. Leaders can also moderate by hand.
• Chat hours. Conversations close outside the hours your organization has set, and open again afterwards. Messages sent to you while chat is closed will still be there.

Automatic scanning is a prompt for a human being to look. It is not a judgement, it is not always right, and it does not replace a safeguarding process. A flag can be raised about a conversation that turns out to be entirely innocent, and a genuinely worrying conversation can go unflagged.

Your organization can suspend or remove your account at any time, for its own reasons.

We can suspend an account or an organization where we reasonably believe there is a risk to a young person, a breach of these terms, or unlawful activity. Where the concern is about immediate safety we may act first and explain afterwards.

Suspension stops you using the service. It does not delete anything. Your messages, the deleted-message log and the audit trail remain, because removing the evidence of a safeguarding concern at the moment a concern is raised would defeat the purpose of keeping it.

To appeal, contact your organization first. If the suspension came from us, write to [Contact email for account decisions].

What you write stays yours. You give us permission to store it, transmit it, and show it to the people in your organization who are entitled to see it — which is what “sending a message” means here. We do not sell it and we do not use it to advertise to you.

You are responsible for what you send, and for having the right to send it. Do not upload someone else’s photograph, document or personal information without their agreement.

You cannot require us to erase safeguarding records on demand. The privacy policy explains where that limit comes from and what you can ask for instead.

We try to keep the service running and we will give notice of planned maintenance where we can. We do not promise it will always be available, that messages will always arrive immediately, or that nothing will ever go wrong.

Do not rely on AngelLink for anything urgent. If a young person needs help now, use the phone.

Nothing in this document limits liability that the law does not allow to be limited — including liability for death or personal injury caused by negligence, or for fraud.

Beyond that, the limits of our liability are [Limitation of liability — to be drafted by counsel], and they will depend on the law that ends up governing this agreement.

One thing is worth saying plainly, and it will survive whatever a lawyer writes here: the safeguards in this service reduce risk. They do not remove it, and they are not a substitute for an organization’s own safeguarding policy, training and vetting. Software cannot supervise people on its own.

We may change these terms. Where a change materially affects you we will give notice before it takes effect, by [Notice method — to be confirmed] and at least [Notice period — to be confirmed] in advance.

If you do not accept a change, stop using the service and tell your organization.

This particular version is a draft and has never taken effect. It has no version number and no date, deliberately.

You can stop using AngelLink whenever you like. Ask your organization to close your account.

Closing an account stops you signing in. It does not remove the conversations you took part in, because other people were in those conversations too and the organization still has a duty to be able to review them. How long that material is kept afterwards is set out in the privacy policy.

About your account, your conversations, or a decision made about you: your own organization, first.

About the service itself: [Contact email for legal notices], or write to [Registered address].

The law that governs this agreement and the place any dispute would be heard are [Governing law — to be confirmed by counsel] and [Dispute venue — to be confirmed by counsel]. This service is intended to operate under [Applicable regulation — to be confirmed by counsel]. We make no claim to be certified or compliant under any regime until someone qualified has said so.