ScopeApproved – Terms of Sale and Terms of Service

Effective 2 November 2026.

These Terms (also called conditions générales de vente et d'utilisation, CGV/CGU) apply to every use of scopeapproved.dev and to every purchase made on it. By using the free pre-check or buying a kit or the annual renewal, you accept these Terms. The Acceptable Use rules in section 13 and the Privacy Policy (https://scopeapproved.dev/privacy) form part of these Terms.

1. Who we are

ScopeApproved (scopeapproved.dev) is operated by Musa Adam Lim EI (entrepreneur individuel, micro-entreprise), trading under the name LIM Agentic AI.

• SIREN: 131 778 235 – SIRET: 131 778 235 00013
• Business address: 130 boulevard Masséna, n° 3059, 75013 Paris, France
• Email: support@scopeapproved.dev
• Phone: +33 7 51 20 33 63
• VAT: TVA non applicable, art. 293 B du CGI (VAT not applicable under article 293 B of the French General Tax Code).
• Director of publication: Musa Adam Lim
• Host: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, +1 650 319 8930.
• Data storage: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513.

In these Terms, "we" and "us" mean Musa Adam Lim EI, trading as LIM Agentic AI, and "you" means the person or organisation using ScopeApproved. A "consumer" is an individual acting for purposes outside their trade, business, craft or profession. A "business customer" is anyone else.

2. Not affiliated with Google

ScopeApproved is an independent service. It is not affiliated with, endorsed by, sponsored by, or approved by Google LLC, the App Defense Alliance, or any CASA-authorised assessor. Google, Google Cloud, Google OAuth, Gmail, Google Drive and Google Workspace are trademarks of Google LLC. We use these names only to describe what our service helps you prepare for.

Only Google decides whether your OAuth app is verified, and only an authorised CASA assessor (lab) can issue a CASA Letter of Validation. We do not submit anything to Google on your behalf, we do not have access to your Google Cloud project, and we cannot influence Google's or a lab's review.

3. The service

ScopeApproved helps app developers prepare for Google OAuth app verification for sensitive and restricted scopes, and for the Cloud Application Security Assessment (CASA) that restricted scopes require.

Unless stated otherwise, each kit and each renewal covers one app (one OAuth client in one Google Cloud project, and the scopes you declared when you ordered). Kit materials stay available to download from your account for 12 months after purchase, and for as long as an annual renewal for that app is active.

What is not included. The price of a kit does not include any fee charged by Google or by a CASA assessor. CASA assessments are performed and invoiced by authorised labs, not by us. We do not write code in your app, we do not fix vulnerabilities for you, and we do not talk to Google or a lab for you.

Information you give us. Our output depends on the scopes, URLs and descriptions you provide. Please declare every scope your app requests. Never send us passwords, OAuth client secrets, refresh tokens, API keys or Google user data. We do not need them and will delete them if received.

4. Technical and informational output – not legal advice

Everything ScopeApproved produces (gap lists, scope justification drafts, scripts, checklists, scan results) is technical and informational. It describes what we observed on your public pages and how it compares with Google's published requirements. It is not legal advice and not a legal consultation.

We do not draft, write or rewrite privacy policies, terms of service, data processing agreements or any other legal document for you. Where a gap list says that your privacy policy appears to be missing an element Google asks for, it points to Google's published requirement; deciding what your legal documents say, and making sure they are accurate and lawful, is your responsibility. If you need a privacy policy or other legal document drafted or reviewed, please consult a qualified lawyer.

Scope justification drafts and demo scripts are suggestions. You must check that everything you submit to Google is true and matches what your app actually does.

5. No guarantee of approval

We cannot guarantee that Google will verify your app, that a CASA assessor will validate it, or how long either review will take. Google's requirements and practices change, and reviewers have discretion. A pre-check, kit or pre-scan reflects what our checks could observe at a point in time. It is not a security audit, not a penetration test, not a CASA assessment, and not a certification of any kind. A clean result does not mean your app is secure or compliant. The only promise we make about Google's decision is the refund in section 9.

6. Ownership verification and passive pre-scans

The CASA pre-scan runs only against a domain whose ownership you have verified, by publishing a token we give you either in a DNS TXT record at _scopeapproved-verify.<your domain> or in a file at https://<your domain>/.well-known/scopeapproved-verify.txt. We refuse the pre-scan if verification fails.

The pre-scan is passive: it only sends ordinary read requests of the kind a browser sends, and observes publicly served responses such as security headers, TLS and cookie settings, and publicly exposed files. It does not log in, create accounts, submit forms, send write requests, or attempt to exploit anything. It runs from our scanning server hosted by Hetzner in the European Union.

You may only submit a domain you own or are authorised in writing to test. You warrant that you have that right. Verification shows control of the host; it does not transfer to us your responsibility for having permission.

The free pre-check only fetches your public homepage and privacy policy, as any visitor would.

7. Annual renewal

What it is. Google re-reviews verified apps when scopes or pages change, and apps with restricted scopes must be re-assessed under CASA at least every 12 months. The annual renewal keeps your materials current for that.

How you subscribe. The renewal is optional and opt-in. You subscribe only by choosing it yourself, either by ticking a separate, unticked option at kit checkout or later from your account.

When it starts and how it renews. The renewal starts 12 months after the purchase of the kit it relates to. Your first €199 charge is taken on that date (or on the day you subscribe, if you subscribe later than that), and then every year on the same date, until you cancel. Nothing is charged for the renewal at kit checkout.

Reminder. We email you 45 days before each renewal charge, including the first one, reminding you of the date, the price, and how to cancel (French Consumer Code, article L215-1). If a consumer does not receive this reminder in time, they may cancel free of charge at any time after the renewal date and we refund the unused part of the year.

How to cancel. You can cancel at any time, in a few clicks, from the "Manage subscription" link in your account (Stripe customer portal) or by writing to support@scopeapproved.dev (French Consumer Code, article L215-1-1). No notice period applies. If you cancel before a renewal date, you are not charged on that date. If you cancel during a paid year, cancellation takes effect at the end of that year: you keep the renewal benefits until then and are not charged again. Apart from the cases in this section (missed reminder) and in sections 9 and 10, a year that has started is not refunded pro rata.

Price changes. We may change the renewal price for the future. A change applies at your next renewal only after we give you at least 30 days' notice by email, and you may cancel before it applies.

Failed payments. If a renewal payment fails, Stripe will retry it. If it still fails, we may end the subscription.

8. Prices and payment

Prices are in euros and are charged in euros. VAT is not applicable under article 293 B of the French General Tax Code (TVA non applicable, art. 293 B du CGI). No VAT is added at checkout, and the price shown is the price you pay. Your bank may apply currency conversion fees. Prices may change for the future; the price shown when you order is the price you pay for that order.

Payment is made in full at checkout by card or another method offered by Stripe. Payments are processed by Stripe. We never see or store your full card number. By subscribing to the annual renewal you authorise us, through Stripe, to charge your payment method each year until you cancel. An invoice is available from the Stripe receipt and customer portal. The contract is formed when the payment is confirmed; we then send you a confirmation by email, which includes these Terms or a link to the version you accepted.

9. Approval refund ("Approval guarantee")

The promise. If Google rejects the verification of the app covered by your kit (or by your renewal) for an issue that the kit covered, we refund the full price of that kit (or of that year's renewal).

What "covered" means. An issue is covered if it relates to something our gap list, checklist or justification drafts addressed for the scopes you declared: for example homepage requirements, privacy-policy disclosures Google asks for, the Limited Use disclosure, consent-screen branding and domains, scope justifications, or the demo video content in our script.

How to claim. Email support@scopeapproved.dev from your account email, within 60 days of the date of Google's rejection email, and include:

1. Google's rejection email (forwarded, or a full screenshot showing date, sender and text);
2. the app/OAuth client concerned (project ID or app name as shown to Google); and
3. confirmation that you submitted after following the kit's checklist.

To be eligible, your verification request must have been submitted to Google within 6 months of buying the kit (or within the renewal year concerned). We answer within 10 working days. If the claim is valid, the refund goes back to your original payment method through Stripe within 14 days of our answer.

Exclusions. The refund does not apply where the rejection is caused by:

• an issue outside what the kit covers, including the security findings of a CASA assessment, your app's code or infrastructure, its business model, or Google's policies on prohibited or deceptive apps;
• scopes you did not declare to us, or a scope list you changed after we delivered the kit;
• changes you made to your app, pages, consent screen or submission after our deliverables, or recommendations from the gap list or checklist that you did not apply;
• inaccurate or incomplete information you gave us or Google;
• Google not responding, delays, or a request for more information (only a rejection counts; a request for more information is not a rejection, but we will help you answer it as part of the kit);
• a requirement Google introduced after the date we delivered the kit; or
• a refund already received for the same app and kit.

One refund per kit or renewal year. The refund covers only the price you paid us. It never covers Google or CASA assessor fees, or any other cost or loss. This promise is in addition to, and does not limit, a consumer's statutory rights (section 11).

Other refunds. If a kit cannot be delivered because of an error on our side that we cannot fix within a reasonable time, write to us within 14 days of purchase and we refund it in full.

10. Right of withdrawal (consumers in the EU and UK)

If you are a consumer, you normally have 14 days from purchase to withdraw from a contract for digital content or digital services without giving a reason. To withdraw, send a clear statement to support@scopeapproved.dev (you may use the model form below). We refund all payments received within 14 days of your statement, using the same payment method.

Losing the right of withdrawal. Kits are digital content supplied immediately after payment. At checkout we ask you to tick a box (not pre-ticked) to expressly request immediate supply and to acknowledge that you lose your right of withdrawal once the supply has started (French Consumer Code, article L221-28 13°; for the renewal service, article L221-28 1° once the service has been fully performed). We confirm your consent in the order confirmation email. If you give that consent, the withdrawal right no longer applies once the kit has been made available to you. If you withdraw from the annual renewal within 14 days after asking us to start straight away, but before the service is fully performed, we may keep an amount proportional to what was supplied up to your withdrawal.

Checkout checkbox text:

I expressly request that my ScopeApproved kit is supplied straight away, and I acknowledge that I lose my right of withdrawal once supply has started (French Consumer Code, article L221-28 13°).

Model withdrawal form: "To Musa Adam Lim EI (LIM Agentic AI), 130 boulevard Masséna, n° 3059, 75013 Paris, France, support@scopeapproved.dev: I hereby give notice that I withdraw from my contract for the following service: [offer], ordered on [date], account email [email]. Name: [name]. Date: [date]."

Business customers do not have a withdrawal right.

11. Consumers' statutory rights

If you are a consumer, nothing in these Terms affects your statutory rights, including the legal guarantee of conformity for digital content and digital services (French Consumer Code, articles L224-25-12 and following). If a kit is not in conformity with these Terms, tell us and we will bring it into conformity, or, failing that, reduce the price or refund you as the law provides.

12. Licence to the kit materials

You may use, adapt and submit the kit materials for the app the kit covers, inside your own business or for the client that owns that app. You may not resell, republish or redistribute the kit materials, or use one kit for several apps. You keep all rights in the information and content you give us; you grant us the right to use it only to provide the service to you.

13. Acceptable use

You will not:

• submit a domain for a pre-scan that you do not own or are not authorised in writing to test, or try to bypass ownership verification;
• use ScopeApproved to prepare a misleading submission to Google, misrepresent what your app does with Google user data, or help an app that breaks Google's policies or the law;
• try to break into ScopeApproved, overload it, automate requests to get around limits, or use our checks as a proxy against unrelated systems;
• use the service in breach of the law, including laws on unauthorised access to computer systems (French Criminal Code, articles 323-1 and following).

If you think you have found a security problem in ScopeApproved, please report it to support@scopeapproved.dev and give us reasonable time to fix it before disclosing it.

14. Data

We process personal data as described in the Privacy Policy. In short: we store your account email, the URLs and domains you submit, the scopes and app details you declare, verification metadata, check results, and billing status. We do not store Google user data, OAuth secrets or card numbers. Our processors are:

• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payments, subscriptions, invoices, customer portal;
• Supabase (Supabase Pte. Ltd., Singapore): database for accounts, checks and kits. Region: EU (Frankfurt, eu-central-1);
• Cloudflare (Cloudflare, Inc., USA): website hosting, CDN, security, and Turnstile bot checks on the free pre-check;
• Resend (Resend, Inc., USA): sign-in and notification emails;
• Hetzner (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany): runs the server that performs the passive pre-scan, in the European Union.

Business customers may request a data processing agreement at support@scopeapproved.dev.

15. Suspension and termination

We may refuse an order or a check, suspend, or close an account if you breach these Terms, or if a request looks unauthorised or misleading. If we close an account without a breach on your part, we refund any prepaid, unused renewal period and any kit not yet delivered. You may stop using ScopeApproved and ask us to delete your account at any time by writing to support@scopeapproved.dev.

16. Limitation of liability

To the extent the law allows, our total liability for all claims relating to ScopeApproved is capped at the fees you paid to us in the 12 months before the event giving rise to the claim. We are not liable for indirect or consequential loss, including Google rejecting, delaying, restricting or suspending your app or OAuth client, fees paid to Google or to a CASA assessor, lost users, revenue, profits or data, or a security incident in your app.

Nothing in these Terms limits liability for death or personal injury caused by negligence, for fraud, for gross negligence or wilful misconduct, or any other liability that cannot be limited by law, nor does it affect consumers' statutory rights.

17. Indemnity

If you are a business customer, you will indemnify us against claims by third parties arising from a pre-scan of a domain you were not authorised to test, or from information you submitted to Google or to an assessor.

18. Governing law and disputes

These Terms are governed by French law. If you are a consumer living in another country, you also keep the protection of the mandatory rules of your country of residence.

Please contact support@scopeapproved.dev first. We aim to answer within 5 working days.

If you are a consumer and your written complaint to us has not resolved the dispute, you may refer it free of charge to our consumer mediator (French Consumer Code, articles L611-1 and following and L612-1 and following):

CM2C – Centre de la Médiation de la Consommation de Conciliateurs de Justice 49 rue de Ponthieu, 75008 Paris, France Website: https://www.cm2c.net (online referral: https://www.cm2c.net/declarer-un-litige.php)

You must refer the dispute to the mediator within one year of your written complaint to us. Mediation is conducted in French. Using the mediator is optional, and you keep the right to go to court.

Disputes with business customers are subject to the exclusive jurisdiction of the courts of Paris, France. Consumers may bring proceedings in the courts of their place of residence or any other court the law allows, and nothing in this section limits their statutory rights.

19. Changes

We may update these Terms. We will change the effective date above, and for material changes we will email active renewal subscribers at least 30 days before they apply. The Terms in force when you buy apply to that purchase.

20. Language

These Terms are available in English and in French. The French version is available at https://scopeapproved.dev/cgv. For consumers resident in France, the French version prevails in case of difference. In all other cases, the English version prevails.

21. Contact

support@scopeapproved.dev – +33 7 51 20 33 63 – Musa Adam Lim EI (LIM Agentic AI), 130 boulevard Masséna, n° 3059, 75013 Paris, France.