Asset Custody Policy

Everything Island Todo registers, creates, purchases or configures on behalf of a client is owned by that client.

Island Todo does not hold client assets in its own name, and does not retain any interest, lien or claim over them, whether or not fees are outstanding.

Where a platform distinguishes between an owner and an administrator, the client is the owner and Island Todo is an administrator. Where the client's access can be revoked only by Island Todo, we will say so explicitly in the register and explain why.

Domains are registered to the client's legal entity, at the client's address, with an administrative contact the client controls.

Island Todo will not use its own address, entity or email as the registrant on a client domain. If a domain is currently registered to Island Todo for a historical reason, that fact appears in the register with a date by which it will be transferred.

The client may request a transfer authorisation code at any time, for any reason, without giving one. We will supply it within two working days.

DNS, hosting, mail and certificate configuration is documented in the register, including where each service is hosted and who holds the account.

Social accounts, business profiles, advertising accounts, analytics properties and workspace accounts are held in the client's name, with recovery addresses and phone numbers the client's organisation controls.

Recovery paths will not depend on an Island Todo email address, an Island Todo phone number, or the personal contact details of any individual — ours or the client's.

Advertising accounts sit within the client's Business Manager or equivalent. Island Todo requests partner access, which the client can revoke without contacting us.

Where we hold a credential on the client's behalf, it is stored in a password manager with a documented access policy, and its existence and location are recorded in the register.

On payment of the relevant fee, all intellectual property in work created for a client transfers to that client. Island Todo retains no licence beyond the right to show the work in our portfolio, and even that is subject to clause 4.5.

Source files are released in their original editable format as they are produced — not at project completion, and not on final payment. If a logo is drawn in week three, the client has the vector in week three.

"Source file" means the working file, with layers, paths and editable text intact. A flattened export is not a source file and we will not describe one as such.

Fonts, stock imagery, plugins and software licences purchased for a client project are purchased in the client's name wherever the licence permits. Where a licence cannot name the client, that limitation is recorded in the register at the time of purchase.

Island Todo will not publish, display or describe any client work without the client's written permission, which the client may withdraw at any time. On withdrawal we remove the work from our website and materials within five working days.

Photography and video produced for a client is delivered with a written usage licence in the client's name, stating the permitted uses, territories and duration.

Where a third-party photographer or videographer is engaged, Island Todo secures the necessary rights on the client's behalf before the shoot, and files the release in the register.

Where existing client material has no traceable licence, we record it as a finding rather than assuming it is safe to use.

Every client engagement includes an Asset Register recording, for each asset: what it is, who controls it, when it expires, how it is recovered, and when that recovery path was last tested.

The register is provided to the client on request, at any time, in a portable format, without notice, condition or explanation.

The register is updated whenever an asset changes, and reviewed with the client at least quarterly.

The register does not contain passwords. It records where credentials are held and who may access them.

A client may end an engagement in accordance with the notice period in their agreement. Nothing in this policy is conditional on that notice period being observed.

On termination, for any reason, Island Todo will: remove itself as administrator from every client account, on request or automatically at the end of the notice period, whichever is sooner; provide the final Asset Register; provide a written handover document listing every asset, credential location, renewal date and recovery path; transfer any asset still held in Island Todo's name, at our cost; and answer reasonable questions from the client or their incoming supplier for thirty days, at no charge.

There is no exit fee, handover fee, release fee or administration charge of any kind for the above.

That the client keeps the contact details on their registrar and platform accounts current, and tells us when someone with access leaves.

That the client tells us before transferring an asset elsewhere, so we can update the register rather than leaving it wrong.

That where a client instructs us to act against this policy — to hold a domain in our name for convenience, for example — that instruction is given in writing, recorded in the register, and reviewed annually. We will generally advise against it.

This policy is versioned and dated. Previous versions remain available.

Changes apply from their effective date and are not applied retroactively. Where a change reduces a client's rights, the previous version continues to apply to existing engagements unless the client agrees otherwise in writing.

Material changes are notified to active clients by email at least thirty days before they take effect.

If you believe we have acted against this policy, write to hello@islandtodo.mv. We will respond within two working days with what happened and what we're doing about it.

Anyone — client or not — may check our compliance by running a WHOIS lookup on any domain we manage. The registrant should be the client's organisation. If it isn't, tell us. We'd want to know.