Terms of use (draft)

# Terms of service (DRAFT)

Status: **DRAFT, 2026-10-31. Not legal advice, not published, and the account
service is not open to the public.** These terms are a draft for counsel
review and owner approval. The published version will appear at
`/legal/terms` and will carry a version number and an effective date. Nothing
here is a promise to a customer until it is published.

## 1. Who these terms are between

These terms are between `[OPERATOR LEGAL NAME]`, `[LEGAL FORM]`, registered at
`[REGISTERED ADDRESS]` under `[RCS CITY AND NUMBER]`, VAT number
`[VAT NUMBER]` (the "operator", "we", "us") and the person or entity that
creates an account (the "customer", "you").

The customer is either a consumer or a business. A consumer is a natural person
acting for purposes outside their trade, business, craft or profession. Nothing
in these terms removes a right that the law gives a consumer, and where a
clause conflicts with a mandatory consumer rule, the rule applies.

By creating an account, the customer accepts these terms and the privacy
notice at [`privacy.md`](privacy.md). The account stores the version accepted
at sign-up. If the customer does not accept a later version, they can stop
using the service and close the account.

## 2. The service

The account service provides:

- an account with an email and password sign-in, and sign-in through the
  identity providers that are enabled at the time;
- a profile and an interface language;
- a plan, a subscription and the associated model allowance;
- current usage and the plan limits;
- a model gateway that forwards hosted model calls and meters them.

The service does not host the customer's business data. The local workspace,
the imported rows, the documents, the store and the sessions stay on the
machine that owns them, and the customer is responsible for backing them up.
Deleting an account does not delete the local workspace.

The service does not provide legal, tax or accounting advice. Model answers are
generated content and must be checked by the customer before use.

The beta is invite-only. It is not open to the public, live charges are not
enabled while the beta terms apply, and the operator can change or end a beta
feature with notice.

## 3. Plans and allowances

- The available plans, their prices and their included model allowance are
  shown in the portal and in the plan catalogue at the time of subscription.
  Proposed names and values are placeholders in this draft: `[FREE PLAN]`,
  `[PAID PLAN NAME]`, `[PRICE]`, `[INCLUDED ALLOWANCE]`, `[TRIAL LENGTH]`.
- The paid plan is a flat monthly plan with an included allowance, not a
  per-seat licence. The included allowance is a quantity of model tokens for
  the subscription period.
- When the allowance is used up, the gateway refuses further hosted model
  calls for the period with a typed refusal. The service does not bill overage
  in the first release: there is a hard cap, not a surprise invoice.
- A plan change and its effective date are shown before confirmation. A
  downgrade takes effect at the end of the current period. A failed payment is
  retried for the grace period shown in the portal, after which the plan falls
  to the free allowance and the account data is left in place.
- Prices are shown in euros. Tax is added or included as stated in the portal.
  A business customer can provide a VAT number; the operator confirms the
  applicable invoicing treatment.
- The operator can change plan prices with at least 30 days notice. A customer
  who does not accept a price change can cancel before it takes effect.

## 4. Bringing your own provider key

The local workspace lets its owner configure a model provider key. That
traffic goes directly from the local machine to the provider, not through the
gateway. The customer's contract with that provider applies, and the customer
pays that provider directly. A customer who brings a key does not consume the
hosted allowance; the paid plan is priced with that in view.

The operator does not see, store or meter a provider key configured only in the
local workspace. A provider key must not be pasted into a support request or a
portal form.

## 5. Acceptable use

The customer must:

- use the service only for lawful purposes and within the plan and the rate
  limits shown in the portal;
- keep credentials and workspace credentials confidential, and notify
  `[SECURITY EMAIL]` of a suspected compromise;
- follow the identity provider's own terms when signing in through it;
- not attempt to bypass the allowance, the rate limits, the authentication or
  the isolation between accounts;
- not upload malware, run a denial of service, probe the service without
  written authorisation, or use the service to infringe the rights of another
  person;
- not use the service to build a competing service from its data or outputs
  contrary to the law.

The operator can suspend a feature or the account where the law requires it,
or where the use presents a security, fraud, abuse or legal risk, with notice
where notice is possible. Suspension does not delete the account data by
itself; the data is handled under the privacy notice and the retention
statement.

## 6. Availability, maintenance and backups

- The operator works to keep the service available and will give reasonable
  notice of planned maintenance.
- The beta has no service level commitment. A proposed target and measurement
  window are `[AVAILABILITY TARGET]` and are not a guarantee.
- Account data is backed up with `[BACKUP RETENTION]` and a restore is drilled
  as part of operations. A backup is not a substitute for the customer's own
  backup of the local workspace.
- The customer must keep the local workspace backed up. The operator does not
  hold, restore or migrate the local business data.

## 7. Liability

- The operator is liable for its own faulty performance under the law and
  these terms.
- To the extent the law allows, the operator's liability for direct damage is
  limited to the amount the customer paid for the service in the 12 months
  before the event, or `[LIABILITY CAP]` if that is higher.
- Nothing limits liability for personal injury, fraud, wilful misconduct,
  gross negligence, or any other liability that the law does not allow to be
  limited. Nothing limits a consumer's mandatory rights or a person's data
  protection rights.
- The operator is not liable for the content the customer sends to the model
  provider, for a decision the customer makes from a generated answer, or for
  a service the customer's own provider operates.
- The operator maintains `[INSURER AND COVER]` professional liability cover
  during the term.

## 8. Cancellation, termination and withdrawal

- The customer can cancel from the portal at any time. Cancellation takes
  effect at the end of the current billing period unless the portal states
  otherwise, and the customer keeps the current allowance until then. The
  portal shows the exact date and what is lost.
- The operator can terminate for a material breach, for non-payment after the
  grace period, where the law requires it, or by closing the service with at
  least 90 days notice. On termination, the account is handled under the
  privacy notice and `[RETENTION FOR BILLING RECORDS]` keeps only the minimal
  billing record.
- **Withdrawal right (consumers).** Where the customer is a consumer, the
  customer has 14 days from the conclusion of the subscription contract to
  withdraw without giving a reason, by writing to `[PRIVACY EMAIL]` or using
  the cancellation path in the portal. If the customer asked for the service
  to start immediately and acknowledged losing the withdrawal right for the
  digital service, the withdrawal right may not apply to what was already
  supplied. Counsel confirms the exact wording and the refund rules. A
  business customer does not have the consumer withdrawal right.
- Questions about a refund, a chargeback or an invoice go to
  `[CONTACT EMAIL]` and are handled through the payment provider. Refunds are
  not automated in the first release.

## 9. Privacy and security

The privacy notice at [`privacy.md`](privacy.md) explains what data the
account service collects and why. The subprocessor list is at
[`subprocessors.md`](subprocessors.md). The operator keeps the content of
prompts and completions out of its logs, as described in the privacy notice.

The customer is responsible for the accuracy of its profile data and for
keeping its credentials secret.

## 10. Governing law and disputes

These terms are governed by `[GOVERNING LAW]`, proposed French law, without
prejudice to a mandatory rule that protects a consumer in their country of
residence. Disputes that cannot be settled amicably go to `[COURT CITY]`,
except that a consumer may bring the matter before the court that the law
allows.

Before a court action, a consumer can use the free consumer mediation scheme
the operator joins: `[CONSUMER MEDIATOR]`. Business disputes are handled under
the contract and, if needed, before `[COURT CITY]`.

## 11. French and English

These terms will be published in French and English. The French version is the
one offered to the first customer and prevails if the two versions differ. The
English version is a reference for the operator and for customers who work in
English. Both versions carry the same version number and effective date.
The French version is reviewed by counsel before publication. A consumer whose
language is not French keeps the protection of the mandatory rules of their
country.

## 12. Changes to these terms

The operator versions and dates these terms. A material change is announced at
sign-in, by email, or both, at least 30 days before it takes effect when the
law allows. If the customer does not accept the change, they can cancel before
it takes effect. The account record stores the accepted version.

## 13. Contact

- General: `[CONTACT EMAIL]`
- Privacy and withdrawal: `[PRIVACY EMAIL]`
- Security: `[SECURITY EMAIL]`
- Post: `[OPERATOR LEGAL NAME]`, `[REGISTERED ADDRESS]`

The service is a draft and is not open to the public. These terms take effect
on `[EFFECTIVE DATE]` at version `[VERSION]`.