Terms of service

Last updated 20 August 2026 · TGF Digital Ltd, United Kingdom

These are the terms on which Peregrine is provided. They are deliberately short, because a long contract nobody reads protects nobody.

The short version. First 30 days free. Monthly or annual, per site, cheaper in volume. Your original images are never altered, so you can leave at any time and your site works exactly as it did before. We will not lose your data because we never hold the only copy of it.

Who you are contracting with

TGF Digital Ltd, a company registered in England and Wales. Company number: registration in progress — this page is updated the day it is issued. Registered office: registration in progress — this page is updated the day it is issued. Not VAT registered, so no VAT is added to these prices. Peregrine is a trading name of TGF Digital Ltd. Contact: tgf@xpose.online.

What we provide

Peregrine converts the images on your website to modern formats and delivers them, and on the Dive plan delivers the rest of the site from the same edge network. Shield adds managed firewall rules and bot filtering.

Converted files sit alongside your originals. We never modify, replace or delete an original image. Removing the plugin returns the site to serving exactly what it served before.

Trial and billing

Every plan starts with 30 days free. No payment is taken during the trial, and cancelling before it ends costs nothing.
Prices are per site. The volume discount applies across every site on the account automatically — you do not have to ask for it.
Annual plans are paid up front and include migration. Monthly plans renew monthly. Dive is annual only, because delegating nameservers is a real migration and a one-month experiment helps nobody.
Payments are handled by Stripe. Card details never reach our servers.
TGF Digital Ltd is not VAT registered, so the price you see is the price you pay. If that changes we will tell you before it affects an invoice.

Cancelling

Cancel from the billing portal linked in any Stripe receipt, or email us. Monthly plans stop at the end of the paid month. Annual plans run to the end of the paid year; we do not refund the remainder as standard, but if you are cancelling because the service did not do what we said it would, ask — we would rather refund you than argue.

What you are responsible for

Having the right to use and distribute the images on the sites you put on the service.
The content of those sites, which we do not review.
Keeping your API keys and console password to yourself. Anything done with your key counts as done by you.
Pointing the DNS record. Nothing is delivered until you do.

Acceptable use

The service is for delivering assets for websites. Do not use it to distribute malware, to host material that is unlawful in the United Kingdom, or as general-purpose file storage or a video platform. We may suspend a site that is doing any of those, and will tell you why.

Availability

We do not offer a contractual uptime guarantee, and we are not going to pretend otherwise on a page you can hold us to. What we will say plainly: delivery runs on Bunny.net's edge network rather than a single server of ours, your originals stay on your own hosting throughout, and the failure mode of this service is that your site serves the images it served before us. If we have a bad month, tell us and we will credit you.

Support

Email tgf@xpose.online. We answer the same working day. Shield includes priority response. There is no telephone support, and we would rather not pretend there is.

Your data

Handled as described in our privacy notice. If you leave, tell us and we will delete your converted files and account data; the originals were always yours and were never ours to delete.

Data processing — when the sites are your clients’

Most of our customers are agencies putting client sites on the service. For your own account data we are the controller. For everything that passes through the service on behalf of a site you look after — the image files, and on Dive the page requests and visitor IP addresses in the CDN logs — you are the controller and we are your processor. This section is the Article 28 agreement for that, and it forms part of these terms; you do not need to send us a separate one, though we will sign yours if your client insists.

Subject matter and duration: optimising and delivering website assets, for as long as the site is on the service.
Nature and purpose: converting images to modern formats, caching and serving them and, on Dive, the pages around them.
Types of data: whatever appears in the files on the site, plus request metadata — IP address, user agent, URL requested. We do not ask for special category data and the service is not designed to carry it.
Data subjects: visitors to the sites you put on the service.
We act only on your instructions — using the service is the instruction — and we will tell you if we think an instruction breaks data protection law.
Confidentiality: everyone with access is bound to it. Today that is a very short list, and we will not pretend it is a department.
Security: as described under Security in the privacy notice. Passwords and API keys are stored hashed, third-party credentials are held in root-owned files the web applications cannot read, and everything is served over HTTPS.
Sub-processors: the ones listed in the privacy notice, which is the live list. We will give you 30 days’ notice by email before adding one, and you may object — and cancel with a pro-rata refund if we go ahead anyway.
Breach: we will tell you without undue delay and in any event within 48 hours of becoming aware, with what we know at the time rather than waiting until we know everything.
Your obligations: we will help you answer a subject access request, do a DPIA or deal with the ICO, at no charge for anything proportionate.
Deletion: when a site leaves, its converted files and logs are deleted within 30 days. The originals were never ours. Ask and we will confirm in writing when it is done.
Audit: ask and we will answer questions and show you configuration. We are too small to hold an ISO 27001 certificate and will not imply otherwise.
International transfers: storage and processing are in the EU and UK. Stripe and Google may process in the US under their own transfer safeguards; both are named in the privacy notice.

Liability

Our total liability to you in any twelve-month period is limited to what you paid us in that period. We are not liable for indirect or consequential losses, such as lost profits or lost business. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.

Changes

We may change these terms. If a change materially affects you we will email you at least 30 days beforehand, and you may cancel and be refunded for any unused period if you do not accept it. Price changes never apply mid-term.

Law

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

These terms describe how we actually intend to behave, but they have not been reviewed by a solicitor. If you are putting a large portfolio on the service and need reviewed terms first, say so and we will get them reviewed.