Terms

Who you are buying from

The Blueprint is sold by Vexwatch, operated as a sole proprietorship based in the Netherlands. Formal registration details (the registered business name and Dutch Chamber of Commerce, KVK, number) will be added here once registration is complete. In these terms, "we", "us", and "Vexwatch" mean that business, and "you" means the person or organisation placing the order.

For any question about your order or a refund, email hello@vexwatch.com.

What you are buying

The Vexwatch CRA Blueprint is a set of downloadable document templates and written guides that help a small software or hardware team work towards compliance with the EU Cyber Resilience Act (Regulation (EU) 2024/2847). It includes:

• a scope and classification memo template
• a coordinated vulnerability disclosure policy
• a disclosure workflow with a security.txt template
• the CRA reporting runbook
• RACI and internal register templates
• an SBOM starter guide
• annotated policy examples

You are buying documents only. The Blueprint does not include consulting, meetings, or personal support, and there is no support beyond the documents themselves.

Pre-order and delivery

This is a pre-order. The Blueprint is in production. First documents are delivered from August 2026. The full version 1 is delivered on launch, which we are targeting for September 2026. These dates are our current plan, not a fixed guarantee, which is why the refund terms below give you a clear way out if delivery slips.

Delivery is digital. We send the documents to the email address you use at purchase, so please make sure it is correct and that you can receive mail from us.

Price, tax, and payment

The founding price is EUR 49, charged one time. Depending on where you are, VAT or other sales tax may be added at checkout, and the amount shown at checkout is the amount you pay.

Payment is handled by a third-party merchant of record (Lemon Squeezy or Paddle). The merchant of record is the seller of record for tax purposes and looks after EU VAT and invoicing. Your payment and card details are handled by them. Vexwatch does not receive or store your card details.

Refunds and right of withdrawal

Because this is a pre-order for digital content, refunds work in three layers.

1. Full refund any time before delivery

You can ask for a full refund at any time before the Blueprint is delivered to you, for any reason. Just email hello@vexwatch.com and we will refund you in full.

2. Backstop if we are late

If version 1 has not been delivered by 31 December 2026, you are entitled to a full refund. You do not lose this right by having received earlier draft documents in the meantime.

3. Your statutory right of withdrawal

As a consumer in the EU, you normally have 14 days to withdraw from a distance purchase (Consumer Rights Directive 2011/83/EU, Article 9). There is one point to understand for digital content like this Blueprint.

When the Blueprint is delivered, we will ask you to do two things before you can access or download it: to give your prior express consent that we begin supplying the digital content immediately, and to acknowledge that, by accessing or downloading it, you lose your 14-day right of withdrawal for the content you have received (Consumer Rights Directive 2011/83/EU, Article 16(m)). We will confirm that consent and acknowledgement to you on a durable medium (for example, by email).

In plain terms: until you choose to access the delivered documents, your withdrawal right stands, and layer 1 above already lets you cancel for a full refund before delivery. Once you access or download the content, you keep it, and the 14-day statutory withdrawal right no longer applies to that content. You do not have to waive anything; if you prefer not to, do not access the content and ask for a refund instead.

Your licence to use the templates

When the Blueprint is delivered, you get a licence to use and edit the templates for your own organisation's CRA compliance. If you are a consultant or agency, you may also use the templates in deliverables you produce for your own clients.

What you may not do is resell or redistribute the templates themselves, whether on their own or repackaged, as a competing product or template pack. In short, use the templates in your own work and your clients' work; do not turn them into a product that competes with the Blueprint.

The free Scope Checker

Our site includes a free Scope Checker that asks questions about your product and gives an indicative verdict on whether, and how, the EU Cyber Resilience Act may apply to it. These terms also govern your use of the checker and of any verdict, report, or other output it produces, whether or not you buy the Blueprint.

The checker is an automated, informational self-assessment. Its output is based only on the answers you give and on our reading of the CRA at the time the decision tree was last updated, and it may not reflect your specific circumstances or the most recent regulatory guidance. It is compliance tooling, not legal advice, it creates no client or advisory relationship, and it is not a determination by or on behalf of any regulator or authority. Verify its conclusions against Regulation (EU) 2024/2847 or qualified counsel before relying on them.

No warranty, not legal advice

The templates and guides, and the free Scope Checker and its output, are provided "as is". They are compliance tooling, not legal advice. They do not guarantee any particular regulatory outcome, and they do not guarantee that a national authority will accept your documentation or agree with a checker verdict in any given case. Your obligations under the CRA depend on your own product and circumstances. For advice on your specific situation, consult a qualified lawyer.

Liability

To the extent permitted by law, our total liability to you in connection with the Blueprint and these terms is limited to the amount you paid for it. The scope checker is provided free of charge, and, to the extent permitted by law, we accept no liability for any loss or damage arising from your use of, or reliance on, the checker or its output. Nothing in these terms limits or excludes liability that cannot be limited or excluded under applicable law, and, if you are a consumer, your mandatory statutory rights are not affected.

Consumers and businesses

Some buyers are businesses and some are individual consumers. The right of withdrawal described above is a consumer right and applies to you if you are buying as a consumer, that is, outside your trade, business, or profession. If you are buying for a business, that specific statutory withdrawal right does not apply to you, but the pre-delivery refund (layer 1) and the late-delivery backstop (layer 2) still do.

Governing law

These terms are governed by the law of the Netherlands. If you are a consumer, this does not deprive you of the protection of mandatory consumer-law provisions of the country where you live, which continue to apply (Rome I, Regulation (EC) No 593/2008, Article 6).

Changes to these terms

We may update these terms over time. The version in force at the time you place your order governs that order, so a later change does not alter what you agreed to when you bought.