Legal · last updated 20 August 2026
These terms are the contract between you and Innovazione su Misura di Catana Petronela, the business that operates Timbaly. They say what the platform does, what you pay, who owns the website you build with it, what a connected Google account gives us access to, and what happens when either side stops.
The short version: plans are per site and per month — Free €0, Pro €19, Business €79. Cancellation always takes effect at the end of the period you have already paid for. The pages, the content and the Search Console property are yours, and they stay yours if you leave.
Contents
Timbaly is operated by Innovazione su Misura di Catana Petronela, registered office at Via Val Della Torre 81, 10149 Torino (TO), Italy, VAT number 12533670019 — referred to below as “Timbaly”, “we” or “us”. Written contact: info@timbaly.com.
These terms apply from the moment you create an account on timbaly.com, and they cover the admin panel, the sites you publish with it, the API keys you generate and any assistant you connect over the MCP surface. If you do not accept them, do not use the service.
If you are using Timbaly as a consumer rather than in the course of a business, the mandatory protections of Italian and EU consumer law apply to you and nothing here reduces them.
Timbaly is a multi-tenant CMS that generates and maintains websites with AI, optimised for search engines and for generative engines. One installation serves many sites, separated by domain; each site has its own content, media, editorial plans, audit, analytics and configuration.
What the service includes is described on the product pages and, in technical terms, on the automatic technical SEO page: page generation, sitemap.xml, robots.txt, llms.txt and IndexNow, the Google Search Console and Bing Webmaster connections, PageSpeed measurement, site audit, SEO plans, first-party analytics, and management from Claude or ChatGPT over MCP.
What Timbaly is not: it is not a web agency and not a managed service. Nobody writes, reviews or approves your pages for you. The platform proposes; you confirm and publish.
To open an account you must be at least 18 and legally able to enter into a contract, and the details you give us must be accurate and kept up to date.
Everything done with your credentials is treated as done by you. The same applies to the API keys you generate — they carry the prefix timbaly_sk_, they can be revoked at any time from the panel, and revoking one is the right first move if you think it has leaked. Tell us at info@timbaly.com if you believe your account has been accessed by someone else.
An account may hold as many sites as you want, each with its own plan. Free sites are capped at five per account.
The plan is per site, not per account. Twenty client sites are twenty subscriptions; there is no artificial ceiling on how many sites an account may hold. The current figures are on the pricing page and, at the date above, are these:
| Plan | Price | Monthly AI budget on the platform key | Indexable |
|---|---|---|---|
| Free | €0 | $1.50, counted per user across all their free sites | No — served with noindex, on a platform subdomain, with a visible badge |
| Pro | €19 a month | $5 per site | Yes |
| Business | €79 a month | $20 per site | Yes |
Prices are in euro. VAT is applied where it is due, according to your country and your status, and the total is shown before you confirm the payment. Payment is handled by Stripe, through its hosted checkout and customer portal: your card details never reach our servers and we never see them.
Paid plans renew every month until you cancel. Cancellation always takes effect at the end of the period you have already paid for, never immediately — those days are paid for, so you keep them. There is no pro-rata refund of a period already started, no paid trial, and no coupons. The euro is the only currency; a non-EU card is converted by the card network, not by us.
If a card is declined, the site is not switched off. Stripe retries for several days and most recoveries succeed. De-indexing a live website over an expired card would be an irreversible harm out of all proportion to the debt.
The monthly AI budget is a ceiling on the platform's own model key, not a wallet: extra credit cannot be bought. When it runs out you either wait for the new month or connect your own model key (OpenRouter or Google Gemini), which removes the ceiling entirely because the spending is then yours.
You keep every right you already had over the text, images, data and business information you put into the platform, and you own the pages generated for your site. We do not claim authorship of them and we do not resell them.
To run the service we need a licence, and you grant us one: non-exclusive, worldwide, for as long as your account is open, limited to storing, processing, translating, indexing and publishing your content for the purpose of operating your site. It ends when the content is deleted.
The platform itself — the software, the design system, the audit and generation pipelines, the Timbaly name and marks — stays ours. Nothing here transfers it to you.
The Google Search Console property is created inside your own Google account, in your name. If you leave the platform it stays yours, with its sixteen months of history. The same applies to a custom domain: it is registered by you, with your registrar, and we never hold it.
You are responsible for the lawfulness of what you publish and for holding the rights to it. That includes the personal data of your own visitors: for the sites you run on Timbaly you are the data controller, and we act as processor on your instructions.
Pages on Timbaly are written by language models, and they are marked as AI-generated in line with the transparency duty of art. 50 of the EU AI Act. You decide whether a page is published, and once it is published you are its publisher.
Generation is not deterministic. In measured runs roughly one page in ten failed on a model loop; the row stays in the plan with a Retry, and the rest of the site is unaffected. Read what a page says before you publish it: a model can be confidently wrong about your own business.
We do not guarantee a position in any ranking, and nobody honestly can. We also do not promise that ChatGPT, Claude, Perplexity or Gemini will cite you: those engines expose no console and no measurement API, so that visibility can be optimised and declared but not measured. What is measurable — Search Console, Bing Webmaster, PageSpeed, IndexNow, the internal audit — is what the panel shows. The FAQ says the same thing at more length.
Privacy and cookie pages are not written freely by a model: they are fixed template text filled in with your site's details, precisely because an invented retention period is not a policy but an exposure. They still need one review by a lawyer for your jurisdiction before you rely on them.
Do not use Timbaly to publish or do any of the following:
Building sites for your clients is not on that list: it is a supported use, described on the page for agencies and freelancers. One client site is one subscription.
Every one of these connections is optional, is started by you, and can be undone by you.
When you connect a Google account, Google shows you a consent screen listing exactly what Timbaly is asking for. There are three permissions, and each exists for one job:
| Permission requested | What it is used for |
|---|---|
webmasters | Create the Search Console property for your domain, declare the sitemap, and read the search performance figures — clicks, impressions, CTR, average position, indexing state — shown in your panel |
siteverification | Prove to Google that you own the domain, using the verification meta tag that the platform writes into the head of your site. This is the step almost everyone gets stuck on when connecting Search Console by hand |
userinfo.email | Display which Google account is connected, so you can tell one from another |
What we do with what Google returns: the search performance figures are stored on our servers, attached to your site, and shown only inside your panel. The access and refresh tokens are encrypted at rest. We do not use Google user data to train AI models, we do not sell it, we do not use it for advertising, and we do not pass it to anyone beyond the infrastructure providers that run the service on our behalf.
Timbaly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect at any time from Settings → Search visibility. That revokes the token and removes the verification tag from your site; the Search Console property itself remains in your Google account, because it always was yours. You can also revoke access directly from your Google account's security settings.
Bing has no consent screen: you generate an API key in your own Bing Webmaster account and paste it in. It is stored encrypted and used only to read your figures for those search engines.
On Pro and Business you may connect your own OpenRouter or Google Gemini key. It is stored encrypted and used only to generate content for your sites. What that provider does with the prompts is governed by its terms, not ours, and the spending is billed to you by them.
If you connect an assistant over MCP, the content it reads and writes travels to that assistant's provider under your own subscription and their terms. We do not bill for that reasoning and we do not receive a copy of your conversation.
How personal data is handled across all of this is set out in the privacy policy.
We keep the service running with reasonable care, but we do not offer a service level agreement and we do not promise uninterrupted availability. Maintenance, provider failures and events outside our control can interrupt it. On the Free plan there is no availability commitment at all: it is a demonstration, not a reduced edition.
Support is by email, in Italian and in English, through the contact page, which delivers to info@timbaly.com. There is no phone line and no live chat, and we would rather say so than let you wait for one.
You can cancel a plan or delete a site at any time from the panel. Cancellation takes effect at the end of the paid period, as set out above.
We may suspend or close an account that breaches these terms, that is used unlawfully, or whose payment has failed after Stripe has exhausted its retries. Except where the law or the seriousness of the breach requires immediate action, we tell you first and give you a chance to fix it.
Export what matters to you before you close an account: once the site stops being served, its content is removed from our active systems, and backups then rotate out on their own cycle. A custom domain is unaffected — it is yours and points wherever you tell it to.
The service is provided as it is. To the extent the law allows, we exclude implied warranties of fitness for a particular purpose, and we are not liable for lost profits, lost business, or loss caused by a search engine's or a generative engine's own decisions about your site.
Where we are liable, our total liability towards you for any twelve-month period is limited to what you actually paid us for the site concerned in that period. Nothing in this clause limits liability for wilful misconduct or gross negligence, for death or personal injury, or anything else that Italian law does not permit to be limited — including the rights of consumers.
You remain responsible for what you publish, and you cover us for third-party claims arising from your content or your use of the service in breach of these terms.
These terms can change: the law changes, and so does the product. When a change materially affects you we announce it in the panel or by email at least 15 days before it takes effect, and the date at the top of this page changes with it. If you do not accept the new version, cancel before it applies; continuing to use the service afterwards means you accept it. The version in force is always the one published here.
These terms are governed by Italian law. If you are acting as a business, the courts of Turin have exclusive jurisdiction. If you are a consumer, you keep the right to bring proceedings before the court of the place where you live, and you may use the European Commission's online dispute resolution platform at ec.europa.eu/consumers/odr.
Talk to us first, though: most of what ends up in front of a judge started as an email nobody answered. Ours is info@timbaly.com.
This page is written from a fixed template filled in with the details of the business that runs the platform, for the same reason the privacy policy is: a clause invented by a language model is not a contract, it is an exposure. It should be reviewed once by a qualified lawyer before you rely on it in a dispute.