{"slug":"terms","version":"v1","effectiveDate":"2026-10-12T22:00:00.000Z","draft":false,"title":"Kortyx Cloud Terms of Service","sections":[{"title":"1. Parties, scope and definitions","text":"1.1 These Terms govern the hosted Kortyx Cloud service made available by Kortyx (“we”, “us” or “our”) to the person or organization entering into the agreement (“Customer”, “you” or “your”). Our legal contact is legal@kortyx.io. See also the [Legal Notice](https://kortyx.io/legal/v1).\n\n1.2 “Cloud” means the hosted observability and application-evaluation functions that Kortyx makes available under your account, together with the interfaces required to use those functions. “Authorized User” means an individual whom you permit to access your organization or projects through the applicable access controls. “Customer Content” means the data submitted to, stored in, or generated for you through Cloud, including prompts, outputs, traces, tool activity, datasets, evaluation inputs and results, and associated application metadata. “Documentation” means the published instructions for the relevant supported version and functions of Cloud.\n\n1.3 “DPA” means the [Data Processing Agreement](https://kortyx.io/cloud/dpa/v1), including its completed annexes, governing our processing of personal data in Customer Content on your behalf. “Applicable Law” means the laws and binding regulatory requirements applicable to a party's performance of its obligations. References to a day mean a calendar day unless expressly stated otherwise.\n\n1.4 These Terms apply to hosted Cloud. They do not replace the licenses supplied with the Kortyx SDK, self-hosted Studio, examples or other distributed software. Operating software on your own infrastructure does not, by itself, make Kortyx the host of your application data or establish a Cloud contract. Optional telemetry transmitted to Kortyx by distributed software is addressed separately in the [Website Privacy and Software Telemetry Notice](https://kortyx.io/privacy/v1).\n\n1.5 The [Cloud Privacy Notice](https://kortyx.io/cloud/privacy/v1) explains our own account and operational processing. It is a transparency notice, not a request for blanket consent to every use of personal data. The [Cookies and Storage Notice](https://kortyx.io/cookies/v1) describes browser-storage choices. Acceptance of these Terms is separate from optional analytics, marketing subscriptions and onboarding answers."},{"title":"2. Eligibility, authority and agreement formation","text":"2.1 Account holders must be at least 18 years old and legally capable of entering into this agreement. Cloud is intended for business, professional and personal hobby use. Mandatory consumer rights apply where you act outside your trade, business or profession and the relevant law protects you as a consumer; a work email address or organization name does not alone settle that question.\n\n2.2 If you enter into this agreement for an organization, you confirm that you have authority to bind that organization. If you do not have that authority, you must not purport to accept on its behalf. An organization's invitation or assignment of a product role does not override any legal limits on the representative's authority.\n\n2.3 Before acceptance, we will make the applicable Terms and incorporated documents available for review and saving. The agreement is formed through the affirmative acceptance process associated with the relevant account or organization. We record the accepted version and the relevant acceptance evidence. Visiting a legal page, opening an email, answering an optional survey or selecting cookie preferences does not constitute acceptance of these Terms.\n\n2.4 Each person accessing Cloud completes their own version-bound acceptance. If you accept for an organization, section 2.2 applies; an invitation or another member’s acceptance is not a substitute for your required acceptance. We retain account-linked acceptance evidence. You can save the permanent document copy, and request confirmation at legal@kortyx.io. The accepted DPA and its annexes are identified with the relevant Terms release.\n\n2.5 Our initial commercial focus is the United States and European Union. Access elsewhere is subject to Applicable Law and actual service availability. You must not use Cloud where its provision or your use is prohibited by applicable sanctions or export restrictions. We do not promise availability in every jurisdiction or that every use is suitable for local regulated activities."},{"title":"3. Accounts and organization administration","text":"3.1 You must provide accurate account information, keep necessary contact details current, and safeguard your credentials and recovery methods. You must promptly notify us through the security contact if you reasonably suspect unauthorized access. Do not share an individual's sign-in credentials as a substitute for inviting additional Authorized Users.\n\n3.2 You control the users, roles, projects and integrations that you are authorized to administer. You are responsible for instructions given by your properly authorized representatives and for reviewing access when a person's responsibilities change. We remain responsible for applying our own authorization controls and for failures attributable to our service.\n\n3.3 Organization administrators may exercise the powers actually assigned to their roles, including managing access to organization information. They do not obtain a general right to another person's unrelated organizations, private correspondence, or legally protected information. Personal account closure and deletion of a shared organization are distinct actions.\n\n3.4 We may require proportionate evidence of identity or authority before changing organization ownership, disclosing an export, recovering access or acting on a disputed instruction. We may pause a disputed administrative action while investigating conflicting claims. We will not resolve an ownership dispute solely because someone controls an email domain."},{"title":"4. Free service, limits and support","text":"4.1 Cloud v1 is offered without subscription charges for the functions made available as part of the free service. It has no contractual uptime service-level agreement or service-credit program. This does not remove obligations expressly undertaken in these Terms or the DPA, or mandatory obligations under Applicable Law.\n\n4.2 Capacity, supported functionality and technical limits are described in the applicable Documentation or the relevant feature interface. You must not circumvent those limits. We may apply proportionate rate limits to protect service operation, with advance information about ordinary changes where practicable. A rate limit is not permission to delete content outside the disclosed lifecycle.\n\n4.3 Free-tier product assistance is provided through the community channels identified on the website. There is no guaranteed response time or dedicated technical-support entitlement. Privacy requests, security reports, contractual notices and legally required assistance have their own private channels and are not conditional on community participation or a paid subscription.\n\n4.4 We may offer paid plans later. Any price, billing period, tax treatment, renewal conditions and additional support commitments will be disclosed before purchase. These Terms do not authorize an automatic charge, conversion to a paid plan or use of saved payment details without an affirmative purchase decision. If free functionality is discontinued, the change and exit provisions below apply."},{"title":"5. Customer Content and intellectual property","text":"5.1 As between the parties, you retain the rights you hold in Customer Content. No provision transfers ownership of your application, datasets or underlying content to Kortyx. Ownership and permitted use of third-party or model-generated material remain subject to the rights that actually exist in that material.\n\n5.2 You grant Kortyx a limited permission to receive, host, reproduce, organize, display, transmit and otherwise process Customer Content only to deliver, support and secure your service in accordance with this agreement and your lawful instructions. This permission includes supported evaluations, authorized exports, incident investigation and the agreed backup and deletion lifecycle. It extends to appointed providers only to the extent necessary for those purposes and subject to the applicable contractual protections.\n\n5.3 We will not sell Customer Content, use it for advertising, use it to train models, or use it for unrelated product research. We will not avoid these restrictions by labelling trace or prompt content “telemetry”. Operational information about use of Kortyx itself is separately described in the Cloud Privacy Notice and must be collected within its disclosed scope.\n\n5.4 You must have the rights and lawful basis needed for Customer Content and for the instructions you give. This includes providing notices to, and obtaining permissions from, your own users where required. These duties do not excuse Kortyx from its own security, confidentiality or data-protection responsibilities.\n\n5.5 Kortyx and its licensors retain their rights in Cloud, its hosted interface, Documentation and branding, subject to the licenses expressly supplied with particular materials. During the agreement you may access the hosted service for its intended functions within your authorized account and documented limits. Nothing restricts independent rights granted under an applicable software license or a mandatory legal right.\n\n5.6 You are not required to provide product feedback. If you voluntarily provide suggestions or recommendations as product feedback, including during interviews, demonstrations, surveys, support discussions or design-partner sessions, you grant Kortyx a worldwide, royalty-free, non-exclusive permission, for the duration of the relevant rights and irrevocable to the extent permitted by law, to use that feedback to develop, modify and commercialize its products and services without compensation to you. Merely providing feedback or participating in those activities does not give you ownership, joint ownership, royalties, an approval right or exclusivity in Kortyx-developed features or improvements. Kortyx and its licensors retain the rights they hold in those developments. This permission does not transfer ownership of Customer Content, private code, personal data or confidential material, override an applicable confidentiality or separately agreed development agreement, or grant rights you lack authority to grant. Actual code, documentation or other authored contributions are governed by their applicable contribution agreement and licenses; submitting a pull request is not an assignment of copyright under this feedback clause."},{"title":"6. Permitted data and regulated use cases","text":"6.1 Cloud's standard service supports ordinary personal and business data within the scope of the DPA. You should select the information necessary for observability, use supported exclusion or redaction controls before transmission, and review inputs, outputs, tool results, errors and metadata. Removal of names alone does not necessarily make information anonymous.\n\n6.2 Passwords, private keys, authentication tokens and payment-card details must not be included in traces, prompts or other observability content. Credentials needed for an expressly supported integration must be provided only through the designated credential mechanism and used within that feature's documented scope.\n\n6.3 Identifiable health information, GDPR special-category data, criminal-conviction or offence data, and other information requiring additional sector-specific contractual or security arrangements require separate review and express written agreement before submission. Ordinary use of Cloud, acceptance of this DPA, encryption or activation of a redaction feature does not itself provide that approval. Standard Cloud v1 does not include an approved HIPAA offering or business associate agreement.\n\n6.4 These conditions apply to the information and use case, rather than excluding every organization operating in healthcare, human resources or financial services. You must not infer regulated-data support from the fact that your application can technically transmit the information. If restricted information is sent inadvertently, contact us privately with enough detail to locate and contain the issue, without repeating unnecessary sensitive content."},{"title":"7. Evaluations, integrations and external actions","text":"7.1 Where you configure an application endpoint, you instruct Cloud to transmit the required evaluation inputs and use the designated credentials for that endpoint. Your application may call model providers, tools and services chosen by you. Unless expressly supplied by Kortyx as part of Cloud, those providers are engaged under your arrangements and have their own terms, processing practices and charges.\n\n7.2 You must configure integrations within your authority, protect credentials and consider whether an evaluation can trigger external effects. Results may be incomplete or inaccurate and require appropriate human review before consequential use. Cloud is not a substitute for professional judgment or controls required in your application.\n\n7.3 Cancellation or interruption may stop further Cloud activity but cannot reverse an external call or action already performed. An incomplete result does not prove that no external operation occurred. Check the state of your application before retrying an operation that may have consequences.\n\n7.4 Our responsibility for the functions we provide is not excluded merely because an integration is involved. Conversely, connecting your independently selected provider does not make us the operator of that provider.\n\n7.5 For an independently engaged integration, review its terms and data permissions before connecting it. You authorize only the transmissions required for the selected function and must have authority to make that instruction. Disabling a connection does not necessarily erase data already held by that provider; use its applicable controls and request process. This allocation does not diminish Kortyx's responsibilities for its own transmission or for a provider appointed by Kortyx under the DPA."},{"title":"8. Acceptable use and protective measures","text":"8.1 You must not use Cloud to violate Applicable Law or others' rights, distribute malicious code, obtain unauthorized access, defeat tenant isolation, misuse another person's credentials, circumvent documented limits, or materially interfere with the service or other customers. Testing must remain within an authorized scope and must not expose other customers' information.\n\n8.2 Report suspected vulnerabilities to security@kortyx.io. This contact does not, by itself, authorize intrusive security testing or create a bug-bounty entitlement. Avoid including unnecessary personal information, live secrets or exploitable details in public reports.\n\n8.3 Where reasonably necessary to address a material security risk, unlawful activity, serious abuse or a binding legal requirement, we may restrict the affected activity or access. We will take account of the seriousness of the issue and seek to limit the restriction to what is necessary. Where lawful and practicable, we will explain the reason and the steps required to resolve it.\n\n8.4 Immediate restrictions may be necessary where delay would increase the risk or violate law. We will review such restrictions as circumstances develop and restore affected access when the reason is resolved, subject to any lawful termination. Protective suspension does not grant us additional rights to exploit Customer Content or dispense with applicable retrieval and data-protection duties."},{"title":"9. Confidentiality and data protection","text":"9.1 Each party will protect non-public information received from the other that is marked confidential or that a reasonable recipient would understand to be confidential. Customer Content, non-public security information, credentials and private business communications are included regardless of whether they bear a confidentiality label.\n\n9.2 The recipient may use such information only for the relationship contemplated by this agreement and may disclose it only to persons who need it for that purpose and are subject to appropriate confidentiality duties. It will apply reasonable care and the more specific safeguards required by the DPA for personal data.\n\n9.3 The restriction does not apply to information the recipient can demonstrate was lawfully known without restriction, independently developed, lawfully received from another source without a duty of confidence, or made public without a breach. A combination of information is not excluded merely because some individual elements are public.\n\n9.4 A legally required disclosure must be limited to what is required. Where permitted, the recipient will give appropriate notice and cooperate with reasonable protective measures. Neither party is required to disobey a binding legal order. Confidentiality obligations continue after termination while the information remains confidential, subject to lawful retention and deletion duties.\n\n9.5 The DPA governs processing of Customer Content on your behalf. Our own account, security and contractual-evidence processing is described in the Cloud Privacy Notice. Necessary staff access to Customer Content is limited to customer support, operation or recovery, and security or abuse investigation.\n\n9.6 A party that permits disclosure to its personnel, advisers or contractors remains responsible for their compliance with its confidentiality obligations. Disclosures must be limited to a need to know and protected by obligations appropriate to the information. Permission to disclose confidential information does not independently authorize a new subprocessor, an international transfer or a different use of personal data.\n\n9.7 When the relationship ends, each party will return or destroy the other's confidential information on a reasonable request, subject to its applicable retention duties and the agreed data lifecycle. Retained material remains protected and may be used only for the permitted retention purpose. For Customer Personal Data, the DPA controls the return, deletion and residual-copy arrangements; an ordinary internal retention policy does not override those duties."},{"title":"10. Organization name and logo","text":"10.1 An organization whose authorized representative accepts these Terms permits Kortyx to identify that organization as a Cloud customer by displaying its name and logo in the customer list on the Kortyx website. We will follow reasonable brand guidelines provided to us and will not imply sponsorship, endorsement or a broader commercial relationship.\n\n10.2 This permission does not authorize use of an individual's name, profile or image, or identification of an employer solely because an individual registers with a work email address. Testimonials, customer quotations, detailed case studies and other promotional uses require separate written agreement.\n\n10.3 Any revocation, removal or other publicity rights arising under a previously accepted agreement remain enforceable according to that agreement, including an applicable ten-business-day removal obligation. Contractual requests may be sent to legal@kortyx.io. No new publicity permission under these Terms revives a permission already revoked under an earlier agreement."},{"title":"11. Retention, archive and deletion","text":"11.1 Customer Content is retained for the purposes and lifecycle described in the DPA and Cloud Privacy Notice, subject to your supported instructions. These Terms do not promise indefinite storage, an unlimited-storage entitlement or an automatic age-based trace-expiry feature.\n\n11.2 The current workspace lifecycle provides a 30-day recovery window following archive of a project or organization. Archive blocks ordinary workspace access and revokes its API keys. Restoring an eligible workspace requires new keys. On expiry of the recovery window, the workspace becomes eligible for permanent deletion under the applicable cleanup process.\n\n11.3 Account closure, removal from an organization, workspace archive and a data-protection erasure request are different operations requiring appropriate authority. Separately saved datasets, prompt versions and evaluation records can persist independently of a source trace. An authorized deletion request should identify the relevant workspace and copies; we will explain the supported scope and any residual retention under the DPA.\n\n11.4 Backups, security records, request evidence and contractual acceptance records follow the schedules in DPA Annex 1 and Cloud Privacy section 9. Retained copies remain protected and may not be repurposed for advertising or unrelated research. A lawful retention exception is limited to the information and period needed. Backup recovery points are not a customer-access entitlement."},{"title":"12. Service changes and availability","text":"12.1 We may maintain and change Cloud to fix defects, improve security, support interoperability, comply with law, maintain supported dependencies or develop the service. Changes that materially reduce an agreed function require the applicable notice and exit treatment; describing a change as an improvement does not remove those obligations.\n\n12.2 We do not guarantee uninterrupted or error-free availability. You should maintain source data and recovery arrangements appropriate to your application. This statement does not exclude responsibility for our own breach or reduce the safeguards required by the DPA.\n\n12.3 For ordinary planned discontinuation of Cloud or a material function on which your use depends, we will give reasonable advance notice appropriate to the circumstances, subject to any longer period required by Applicable Law or an existing agreement, and explain the affected functions, relevant dates and available export or closure process. A security emergency or binding legal restriction may require earlier action, with as much explanation and mitigation as is lawful and practicable.\n\n12.4 Consumer changes must also satisfy the requirements applicable to the affected digital service, including any required valid reason, absence of additional cost, durable notice and statutory termination right. The consumer provisions below take precedence over a less protective general change clause."},{"title":"13. New Terms and required acceptance","text":"13.1 We may publish updated Terms from time to time. Each version will identify its effective date and have a permanent link. We will notify affected existing customers of material changes through Cloud or email, explaining when the new version is intended to apply and whether acceptance is required. These Terms do not promise a fixed advance-notice period for every update. We will provide the notice, time to consider a change and termination or retrieval rights required by Applicable Law or an existing agreement. We will not replace the text at a historical version link.\n\n13.2 Publishing updated Terms does not by itself change an existing customer's agreement. The existing agreement remains authoritative until a new version validly takes effect for that customer, including completion of any required notice and acceptance process. When affirmative acceptance of a new version is required, publication, continued use, silence or opening a notice does not substitute for acceptance. We will not retrospectively treat the new text as the agreement governing past conduct or overwrite earlier evidence.\n\n13.3 Corrections that do not change contractual rights, obligations or meaning may be communicated without renewed acceptance where lawful. Material changes needed urgently to comply with law or address a serious security risk require a documented reason and the notice permitted in the circumstances. This is not a general power to shorten every notice period.\n\n13.4 Where renewed agreement is required, we may restrict normal interactive Cloud access until you accept the required version. You may instead request authorized retrieval or closure through legal@kortyx.io and the available account controls without accepting that version. Continued automated ingestion or an existing session is not, by itself, a person's affirmative agreement. We may suspend or terminate affected services and disable credentials in accordance with these Terms and the applicable notice. Any retrieval period will provide a reasonable opportunity to retrieve permitted data and exercise closure rights and will not be shorter than required by Applicable Law or an existing agreement. We do not promise indefinite interactive access or storage after termination; restrictions must not make acceptance the sole means of exercising mandatory retrieval, privacy or closure rights.\n\n13.5 Subprocessor additions and replacements follow the separate DPA notice and objection procedure. They do not, merely by occurring, subscribe anyone to marketing or record acceptance of new Terms. Any associated contractual change is assessed and handled separately under this section."},{"title":"14. Termination, retrieval and switching","text":"14.1 You may end your use through the supported closure process or by contacting us privately with an authorized instruction. Ending a personal account does not authorize deletion of a shared organization's content where you lack the necessary authority. We will identify any further authorized action needed to complete the request.\n\n14.2 Either party may terminate for a material breach that is not remedied within a reasonable period specified in a sufficiently detailed breach notice, taking account of the nature, seriousness and practical ability to remedy the breach and any period required by Applicable Law or the applicable agreement. A breach that cannot lawfully or reasonably be remedied, or conduct creating a serious continuing risk, may justify earlier termination to the extent permitted by law. The protective measures in section 8 remain available while the issue is addressed.\n\n14.3 Ordinary termination by Kortyx for business reasons is subject to the discontinuation notice in section 12 and applicable statutory requirements. Free service status is not a general waiver of notice, data protection or mandatory exit obligations.\n\n14.4 Following termination, ordinary access and permission to use hosted Cloud end. Authorized retrieval, legally required switching assistance, deletion and restricted retention continue under Schedule B and the DPA. Confidentiality, accrued rights, dispute provisions and obligations intended by their nature to continue survive for the relevant period.\n\n14.5 Schedule B describes the data retrieval and switching process, including requests following refusal of updated Terms. An ordinary archive-recovery deadline does not shorten a longer applicable retrieval or transition period.\n\n14.6 You should arrange an authorized export or retrieval request within the applicable exit period and verify the delivered copy. We will explain that period and available methods in the termination notice where required. This does not transfer our return, deletion or switching duties to you, shorten mandatory access rights or permit deletion before the applicable period ends. Backup expiry is a separate lifecycle and does not itself extend interactive access."},{"title":"15. Responsibility and allocation of loss","text":"15.1 Each party remains responsible for its own performance and breaches. You are responsible for the applications you operate, the instructions you lawfully control and your independently selected providers. We are responsible for the hosted functions and obligations we undertake. Duties to use reasonable safeguards or maintain copies do not automatically make you responsible for a loss caused by us.\n\n15.2 Cloud is supplied free of charge on an “as is” and “as available” basis, subject to our express obligations and Applicable Law. Kortyx gives no additional warranty of uninterrupted availability, fitness for a particular purpose, error-free operation or compatibility with every application. For professional Customers, to the fullest extent permitted by law and subject to section 15.3, Kortyx excludes liability for indirect or consequential loss, lost profits, revenue, business opportunities and anticipated savings. No uptime SLA, service credits, insurance benefit or provider indemnity is offered. These exclusions do not relieve Kortyx of express security, confidentiality, return or deletion duties.\n\n15.3 Nothing excludes or limits responsibility for deliberate wrongdoing, death or personal injury where exclusion is unlawful, fraud, a data subject’s statutory remedies, mandatory consumer rights, or any other liability that Applicable Law does not permit to be excluded or limited. If an exclusion cannot lawfully apply to a particular loss, responsibility for that loss is determined under the applicable law; the absence of fees does not automatically reduce recoverable liability to zero.\n\n15.4 You remain responsible for losses caused by your own breach to the extent provided by law. These Terms do not impose a separate unlimited indemnity on you or require mandatory arbitration or a class-action waiver. The allocation in this section does not transfer ownership of Customer Content or expand our permitted uses of it."},{"title":"16. Consumers","text":"16.1 If you are a consumer, mandatory protections applicable to you prevail over inconsistent professional-customer provisions. A description of Cloud as free does not alone establish that digital-service consumer rules are inapplicable. We will provide the required precontract information and confirmation in a form you can retain.\n\n16.2 Where the statutory distance-contract withdrawal right applies, you may withdraw within 14 days of entering into the contract without giving a reason. Notify legal@kortyx.io using an unequivocal statement; use of the form in Schedule A is optional. Sending the statement before the deadline is sufficient. The applicable law governs any longer period arising from missing information and the effects of withdrawal.\n\n16.3 We do not treat starting Cloud, accepting Terms or optional analytics consent as a blanket waiver of a withdrawal right. If a particular lawful exception requires an additional express request, acknowledgment or other condition, it must be handled separately and accurately before reliance on that exception.\n\n16.4 Where digital-service conformity rules apply, you may request the legally required remedy for failure to supply or lack of conformity. Depending on the circumstances, remedies include bringing the service into conformity and termination; a price reduction or refund applies where relevant amounts have been paid. The absence of an uptime SLA does not remove these rights.\n\n16.5 Where a qualifying service modification adversely affects access or use beyond a minor effect, the applicable consumer rules may give a separate right to terminate within the statutory period. Under the relevant Spanish rule, that period is 30 calendar days after notice or implementation, whichever is later, subject to the statutory conditions, including any compliant option to retain the unchanged service. This right is separate from our ordinary advance-notice policy.\n\n16.6 You may submit a complaint to legal@kortyx.io. We will consider it under the applicable consumer rules and identify any legally required dispute-resolution information relevant to your complaint. Informal contact does not remove access to competent courts or authorities. We do not represent that we are a member of a particular voluntary arbitration scheme."},{"title":"17. Notices, governing law and general provisions","text":"17.1 Contractual notices may be sent to the designated account or organization contact and displayed in Cloud as appropriate. You must keep that contact current. We will provide a durable form where required by law. Delivery tracking is not proof that a person read or accepted a notice. Marketing opt-out does not prevent necessary contractual or security communications.\n\n17.2 Spanish law governs this agreement. Professional-customer disputes will be heard by the courts competent under applicable jurisdiction rules, with Barcelona, Spain as the agreed venue to the extent that agreement is valid. Consumers retain the mandatory protections and court access of the law otherwise applicable to them.\n\n17.3 Contact the legal channel to seek a practical resolution of a dispute. Informal discussion is not a mandatory delay before seeking urgent relief, complaining to a regulator or preserving a legal deadline.\n\n17.4 The DPA takes precedence for processing of Customer Content; a valid mandatory transfer instrument prevails where its terms require. A signed supplementary agreement prevails only to the extent it expressly addresses the relevant conflict. Informational privacy notices do not silently expand contractual content-use rights.\n\n17.5 Neither party may transfer this agreement in a way that unlawfully reduces the other party's protection. Any permitted transfer associated with a reorganization or sale must require the successor to assume the relevant obligations and include the required notice and data-protection treatment. Formation of the intended company does not automatically transfer a contract made by a different operator.\n\n17.6 If a provision is unenforceable, the remainder continues only to the extent lawful and consistent with the agreement's purpose. Failure to enforce a right on one occasion is not a general waiver. Neither party is the other's agent or partner merely through use of Cloud. This agreement does not override separate software licenses or rights that cannot lawfully be waived.\n\n17.7 To the extent Applicable Law permits, a party is excused from delay or non-performance only insofar as it is caused by an unforeseen event outside its reasonable control whose effects it could not reasonably prevent or overcome. The affected party must notify the other without undue delay, explain the material impact, take reasonable mitigation steps and resume performance as soon as reasonably possible. Routine capacity shortages, lack of funds or an avoidable failure to maintain agreed safeguards do not qualify merely because they disrupt service.\n\n17.8 The exception in section 17.7 applies only to the affected obligation for the relevant period. It does not expand content-use rights or remove mandatory consumer, confidentiality or data-protection duties. The parties must continue obligations they can reasonably perform, including feasible protection and retrieval of data. If a disruption materially defeats the purpose of the affected service and cannot reasonably be resolved, either party may terminate that service by notice, subject to applicable exit, return and deletion duties.\n\n17.9 The operative contract comprises these accepted Terms, the applicable DPA and any expressly agreed supplementary terms. Administrative purchase-order or vendor-portal wording does not amend it unless both parties validly agree. This provision does not erase rights accrued under an earlier version, a binding precontract representation or mandatory law, and does not replace separate software licenses. A change requiring acceptance must use the process in section 13; a later website edit is not itself an amendment."},{"title":"Schedule A — Optional consumer withdrawal statement","text":"To: Kortyx, legal@kortyx.io.\n\nI notify you that I withdraw from my contract for Kortyx Cloud, entered into on [date]. My name is [name], and the account/contact details needed to identify the contract are [details]. My address is [address, where required]. Date: [date]. Signature: [only if submitted on paper].\n\nDo not include passwords, authentication codes or unnecessary identity-document copies. This form is optional and does not restrict another valid method of exercising a statutory right."},{"title":"Schedule B — Retrieval and service switching","text":"B.1 Send an authorized export, switching or closure request to legal@kortyx.io, identifying the organization, projects, requested scope and a secure return contact. Do not send credentials. We will verify authority, explain the available retrieval method and agree how to protect other users’ information. The request channel remains available without acceptance of a later Terms version. The free service has no additional contractual notice period that you must wait out before requesting termination or switching.\n\nB.2 Exportable material comprises Customer Content held for the relevant workspace: recorded runs and traces, captured events and attributes, stored prompt versions, datasets, evaluation inputs/results, and customer-created configuration and metadata necessary to interpret those records. Export excludes another customer’s data, live authentication credentials, platform security secrets, and Kortyx or third-party intellectual property that you have no right to receive. An exclusion will be explained and will not be used to obstruct lawful retrieval of your content. Unrecoverable hashes of revoked credentials are not usable replacement keys.\n\nB.3 Retrieval may use supported product exports or an assisted electronic export in a structured, commonly used machine-readable format, such as JSON, with a description of the exported record types and relationships. A downloadable backup of our entire multi-customer system is not an appropriate tenant export. We do not promise to reproduce every feature, model response or derived behavior in a destination service. We will provide the assistance and interoperability information required by applicable law and cooperate in good faith with your authorized destination provider.\n\nB.4 When the EU Data Act switching provisions apply, the transition will normally complete within 30 calendar days. Any technically necessary alternative must be justified and notified within the statutory 14-working-day period and must not exceed seven months. You may exercise applicable rights to extend the transition. We will maintain the legally required continuity, assistance and security during transition. You will have at least 30 calendar days after transition to retrieve exportable data. Other exits receive a reasonable retrieval opportunity specified in the notice, without reducing mandatory rights. These periods are distinct from the archive-recovery window.\n\nB.5 We charge no switching or standard export fee for the current free service. A proposal for optional, separately commissioned migration work requires a separate agreement and cannot make a mandatory right conditional on purchasing that work. You are responsible for arrangements with your destination provider and for checking the export. Tell us promptly about missing or unreadable material so that we can assess it within the applicable retrieval process.\n\nB.6 On successful switching, or the applicable termination event for deletion without switching, the affected service contract ends in accordance with applicable law. After the retrieval period, or an earlier valid deletion instruction that does not infringe another person’s rights, we delete the affected active content under the DPA. Restricted backup copies follow Annex 1. No ordinary account use is permitted merely because a retrieval copy is retained. Any legal prohibition on disclosure or security restriction will be narrowly applied while preserving lawful alternative retrieval where possible."},{"title":"Attribution for adapted clauses","text":"Sections 9.6–9.7 and 17.7–17.9 adapt elements of the [Common Paper Cloud Service Agreement, version 2.1](https://commonpaper.com/standards/cloud-service-agreement/2.1/), by Common Paper, Inc., available under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). Kortyx has modified the wording and scope for this agreement, including confidentiality/retention safeguards, mandatory rights, free-service operation and affirmative versioned acceptance. Common Paper has not endorsed these changes. This attribution does not incorporate its complete standard agreement or its model-training, payment or other unselected provisions."}]}