Terms & Conditions

1. Introduction and Acceptance

These Terms and Conditions ("Terms") govern access to and use of the Umbrella4AI Limited platform ("U4AI", "Platform", "Company", "Service", "we", "us", "our"), operated by Umbrella4AI Limited (abbreviated as U4AI), a company registered in Cyprus with registration number 471618 and registered address at Kypranoros 13, EVI Building, Floor 2, Nicosia, Cyprus ("Company"). By creating an account, accessing, or using the Platform, the person or entity doing so ("Customer", "Client", "you", "your") agrees to be bound by these Terms.

If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have the authority to bind that entity, in which case "Customer" refers to that entity.

The U4AI Data Processing Agreement (DPA), available at registration and login process when there are amendments, is hereby incorporated by reference into and forms an integral part of these Terms of Service. By entering into these Terms, the Customer agrees to the terms of the DPA. In the event of any conflict between these Terms and the DPA regarding the processing of personal data, the DPA shall prevail.

If you do not agree to these Terms, you must not access or use the Platform.

2. Definitions

Platform / Service: The U4AI software-as-a-service application, including all Services (as defined below), dashboards, reports, and related functionality made available via the U4AI website and application.

Services: The individual functional modules made available on the Platform (e.g. AI Act Classification, AI Risk Analysis, Risk Registry, Impact Assessment, Standards Applicability, and other modules as listed in the current Service Catalogue), each of which may be gated by Subscription Tier and consume Credits as described in Section 4.

Subscription Tier / Plan: The specific access level purchased by the Customer (e.g. Free, Professional, Enterprise, Enterprise Plus, Consultant, or other tiers as published in the current pricing schedule), which determines available Services, included Credits, user seats, and registered company allowances.

Credits: The unit of consumption used to access generation-based Services on the Platform, allocated per Subscription Tier and/or purchased separately, as described in Section 4.

Client Data: Any data, documents, or information the Customer or its Authorized Users upload, input, or generate through the Platform, including information about the Customer's AI systems, business processes, and any personal data contained therein.

Authorized User: An individual authorized by the Customer to access the Platform under the Customer's account, subject to the user-seat limits and permission structure of the applicable Subscription Tier.

AI: Artificial Intelligence models/systems.

AI-Generated Output: Any report, analysis, classification, recommendation, or other content generated by the Platform using artificial intelligence / large language model technology.

Account: a secure digital access profile that authenticates an authorized user to access, configure, and utilize the provider’s software platform.

3. Services Provided

The Platform provides software tools intended to assist organizations in governance and compliance of AI systems with Legislations and related standards, as well as other non-regulated AI frameworks such as NIST AI RM, including but not limited to: AI system inventory management, AI Act risk classification, risk analysis and risk registry generation, impact assessment, standards applicability analysis, Post Market Monitoring, Predetermined Change Control Plan, Incident management, technical documentation support, and related modules as made available from time to time (each a "Service", collectively the "Services").

Available Services depend on the Customer's active Subscription Tier. The Company may add, modify, retire, or rename individual Services from time to time; the Company will provide reasonable notice before retiring a Service that materially reduces the functionality available to an active paying Customer.

The Platform is an AI governance/compliance-support tool. It does not constitute legal advice, and use of the Platform does not, by itself, guarantee compliance with the law or regulation, standards or frameworks. See Section 7 for the AI-Generated Output disclaimer.

4. Subscription Plans, Credits, Upgrades, and Refunds

4.1 Subscription Tiers. The Platform is offered under multiple Subscription Tiers, each with a defined monthly/tier duration price (or invoice-based pricing for custom/enterprise arrangements), number of Authorized User seats, number of registered companies (where applicable), and included Credit allowances, minimum subscription durations, as set out in the Company's then-current pricing schedule published on the Platform or provided to the Customer in writing.

4.2 Credits. Each Subscription Tier includes (a) a one-time allocation of Credits granted at subscription start, valid for 60 days, and (b) where applicable, a recurring monthly allocation of Credits that resets each calendar month on a use-it-or-lose-it basis (unused monthly Credits do not carry over). Generating a report or output through a Service consumes Credits at the rate specified for that Service in the current Service Catalogue. Where a Customer's available Credits are insufficient to use a Service, the Customer may purchase additional Credits ("Top-Up Credits") at the rates published in the current pricing schedule. Top-Up Credits expire 60 days after purchase if unused, regardless of Subscription Tier. The credits are consumed on first expire – consumed first logic. When a subscription to a tier expires, unused account credits are lost.

4.3 AI System Inventory Limits. Each Subscription Tier includes a fixed number of AI systems that may be registered in the Customer's AI inventory. This limit is calculated cumulatively across the lifetime of the account: deleting a previously registered AI system does not reduce the count of systems applied against this limit or free up capacity for a new system. Customers who reach their tier's limit may purchase additional AI system capacity at the rate published in the current pricing schedule.

4.4 Contract Duration and Renewal. Subscriptions are billed monthly/tier duration as set out in the current pricing schedule, unless the Customer selects a fixed-term commitment (e.g. 24-month) in exchange for a discount, following a U4AI offer. Certain Subscription Tiers carry a minimum subscription duration, as specified at the point of purchase; the Customer may not terminate for convenience before the end of any applicable minimum term without being liable for the remaining fees for that minimum term, save as set out in Section 4.6 (Withdrawal) or Section 8 (Termination for Cause). Subscriptions governed by a fixed term are billed automatically at the start of each billing period (monthly or tier duration) for the duration of the fixed term. There are two payment structures: - Tier duration payment (e.g. annually 12 months) is a pay up-front payment. Annual payment comes with a discount as specified at the point of purchase. - Monthly payments are billed monthly on the start of each month for the duration of the tier subscription.

Renewal is not automatic. When the fixed term subscription comes close to a calendar end, the option of renewal is informed to the client via the platform at 30, 7, and 1 calendar day intervals prior to expiry. Renewal is for the same tier and same fixed period, and will be billed automatically for the renewal period, starting at the next day of the ending date of the tier to be renewed (e.g. a 12 month tier expires on 1st Oct of 2027, it is renewed on 15th of Sep 2027, the renewal period of the tier for 12 months starts on the 2nd of Oct 2027). All client purchased items (top-up credits, user seats, AI system capacity, managed companies) are carried to the renewed tier. Renewal does not come with initial gift credits.

When a subscription to a tier expires, account users can still view and download their existing reports for a period of two (2) calendar months following account expiry. Following this 2-month period the account is deleted and users have no access to the platform. Within this 2-month period, customers can renew/upgrade/downgrade their subscription to a tier and continue using the services as permitted by the chosen tier.

Free tier subscriptions are permanently active and do not expire. However, under a free tier when users consume the available credits, there is no option to upgrade user seats, top-up credits or increase AI systems. Free tier accounts can upgrade their tier to a paid tier of their choice.

The Consultant Max tier can be setup with specific functionality following an offer by U4AI. The Consultant Max has no pre-defined limitations (e.g., user seats, AI systems, Managed Clients, Monthly credits, services covered), and there is no fixed price. Consultant Max capabilities, fees, and paying methods are agreed between U4AI and client based on an offer generated by U4AI and a written acceptance by client.

4.5 Upgrades and Downgrades. Customers may upgrade their Subscription Tier at any time; upgrades take effect on the start of the next working day, and the expiry date will be updated according to the minimum subscription duration of the tier chosen; once upgraded the new fees, service features, subscription duration, and credits apply. Upon effect of the upgrade of the Subscription tier, the relevant fees for the subscription duration of the upgrade tier apply. Upon upgrade, the purchased items by the client (top-up credits, user seats, AI system capacity, managed companies) are carried to the new subscription; monthly unused credits are forfeited and the new tier's monthly allotment starts fresh. Customers cannot downgrade their Subscription Tier, or reduce Credits, Authorized User seats or registered companies, while their current Subscription Tier is within the subscription period duration. Once their Subscription Tier period has elapsed, users may choose an alternative Subscription Tier; if a user chooses a new Tier downgraded from their original Subscription Tier that would reduce the Customer below its actual usage (e.g. registered AI systems exceeding the lower tier's limit, per Section 4.3), this may require the Customer to first bring usage within the lower tier's limits, or may be actioned with excess usage flagged as requiring additional purchased capacity.

4.6 Right of Withdrawal. U4AI does not provide its services to individuals (consumers). It operates a B2B scheme. Business Customers (entities and individuals subscribing for purposes within their trade, business, or profession) do not benefit from the statutory consumer withdrawal right, and may cancel future renewals at any time per Section 4.4, without a refund for the current billing period already paid, except as set out in Section 4.7.

4.7 Refunds. Except where required by applicable law (including the withdrawal right described in Section 4.6) or expressly stated otherwise, fees paid are non-refundable, including for partially used billing periods, unused Credits (other than as described in Section 4.2 regarding expiry), or unused Service access. Refunds, where granted at the Company's discretion or as required by law, will be issued to the original payment method used, within a reasonable time and in accordance with the Company's standard refund process.

4.8 Payment and Invoicing. U4AI accepts payments via an external provider. Clients may pay by Credit Card or Bank transfer for full tier period subscriptions (e.g. annually). However, for monthly payments only Credit Cards can be used. Card or Bank transfer payments are processed automatically upon successful purchase, with an invoice generated automatically upon confirmed payment. Prices are exclusive of applicable taxes (including VAT) unless stated otherwise; the Customer is responsible for any taxes applicable to its purchase.

5. Confidentiality and Data Protection

5.1 Data Hosting and Residency. Client Data is hosted on infrastructure located within the European Union (Frankfurt, Germany). Certain sub-processors, in particular third-party AI model providers used to generate AI-Generated Output, process and store Client Data submitted to them outside the European Economic Area (including in the United States), subject to appropriate safeguards such as the Standard Contractual Clauses, as described in Section 5.3 (Sub-Processors) below and in the DPA. Further details on the processing of personal data in the delivery of the Services are set out in the DPA.

5.2 Confidentiality. Each party agrees to keep confidential any non-public information disclosed by the other party in connection with these Terms, including Client Data, business information, and the terms of any negotiated agreement between the parties, and to use such information solely for the purpose of performing its obligations under these Terms. This obligation does not apply to information that is or becomes public through no fault of the receiving party, was already known to the receiving party without a duty of confidentiality, or is required to be disclosed by law or a competent authority (in which case the disclosing party will, where legally permitted, be given reasonable notice).

5.3 GDPR and Sub-Processors. U4AI acts as a data controller for personal data collected for the purpose of generating and administering an account for the platform, and for billing and contract administration. Those data are stored on infrastructure located within the European Union (Frankfurt, Germany). The Company accepts personal data for the registration process of users, including full name and email address. Those data are encrypted at rest (AES-256) and in transit Where Client Data includes personal data, the Company acts as a data processor (or, where relevant, independent controller) on behalf of the Customer, who remains the data controller, in accordance with the EU General Data Protection Regulation ("GDPR") and any Data Processing Agreement ("DPA") entered into between the parties. The Company will process personal data only on documented instructions from the Customer, implement appropriate technical and organizational security measures, and assist the Customer in meeting its own GDPR obligations, as further detailed in the applicable DPA and section 5.3.1 of this document. Across all services, the Company requests to provide anonymized data such as client company roles and departments. It is the responsibility of the client to ensure that those safeguards are followed. The Company may engage sub-processors to provide elements of the Service, including cloud infrastructure and third-party AI model providers used to generate AI-Generated Output. A current list of sub-processors is available on the DPA. The Company will ensure sub-processors are bound by data protection obligations no less protective than those in the applicable DPA, and will notify Customers of material changes to sub-processors in accordance with the DPA.

5.3.1 Mandate on Personal Data (PII) in Free-Text Inputs. The Customer and its authorized users acknowledge and agree that the Platform's free-text input fields are strictly designed for Ai system's information, business-related data, operational notes, and non-personal metrics. Users are explicitly instructed not to enter any Personal Data, Personally Identifiable Information (PII), or sensitive data (as defined under applicable data protection laws, including the GDPR) into these open text fields. The Customer assumes sole responsibility for ensuring that its users comply with this mandate. In the event that a user inadvertently or intentionally submits PII into the Platform, the Customer shall be solely liable for such unauthorized disclosure, and the Provider disclaims all liability associated with the processing of such unrequested PII. The Company uses technical measures (sanitization), as described in the DPA, to avoid transfer of Personal Data introduced by the Customer as free text into the platform, to AI model providers. Those measures do not guarantee that Personal Data will not be transferred.

5.4 Security. The Company maintains reasonable administrative, technical, and physical safeguards designed to protect Client Data against unauthorized access, disclosure, alteration, or destruction, consistent with industry practice for SaaS platforms handling sensitive business and compliance-related information.

5.4.1 User access and rights. Principal user, is the individual who registered client on the platform, on behalf of the client, whether directly or via an account the Platform creates on their behalf as part of a manually arranged subscription; set by default as the company's principal user (similar to the concept of an account administrator). Principal user is a permanent user, and user rights are not transferable by client's self-service methods. Transferring principal user rights to another registered to the platform company user, requires a formal, authorized by client, written request to U4AI. U4AI upon acknowledgment of receipt and authentication of the request, may act on behalf of the client to assign principal user status to another already registered user of the client.

The Principal User is the Customer's own designated representative, authorized by the Customer to manage the Customer's account, subscription, and Users on the Platform, including inviting, removing, and setting the access rights of other Users. The Customer is solely responsible for: (a) its choice of Principal User and any individual to whom the Principal User role is transferred; (b) all actions taken by its Principal User and any Users it invites or grants rights to, including but not limited to invitations issued, permissions granted, data accessed, content generated, and decisions made using the Platform; and (c) maintaining the confidentiality of its Principal User's and Users' credentials. U4AI is not responsible for, and disclaims all liability arising from, any act, omission, or decision of the Customer's Principal User or any User acting under rights the Principal User has granted, including disputes between the Customer's own personnel regarding access or control of the Customer's account.

6. Use of Client Data

As between the Company and the Customer, the Customer retains all rights, title, and interest in and to Client Data. The Company will use Client Data solely to (a) provide and maintain the Service to the Customer, (b) generate AI-Generated Output requested by the Customer, (c) provide customer support, (d) as otherwise necessary to comply with applicable law or as expressly authorized in writing by the Customer, and (e) monitor and improve Company services performance.

The Company will not sell Client Data, and will not use Client Data to train, fine-tune, or otherwise improve any underlying AI model in a manner that could expose that data to other customers, except as separately and expressly agreed in writing.

Upon termination of the Customer's account, the Company will delete or anonymize Client Data within a period, except where retention is required by law or for the resolution of disputes, as further described in the applicable DPA.

Client's registered users reserve the right to view, download and permanently delete their personal data from the Company's storage space. This is elaborated in the Privacy Policy available on the U4AI web site.

7. AI-Generated Output: Disclaimer and Customer Responsibility

The Platform uses artificial intelligence, including large language models, to generate reports, classifications, risk analyses, and other content ("AI-Generated Output"). AI-Generated Output is provided as a support aid and starting point for the Customer's own compliance work, and is generated based on information provided by the Customer and reference material available to the Platform at the time of generation.

AI-Generated Output may contain errors, omissions, or inaccuracies, including in its interpretation or application of legal or regulatory requirements. AI-Generated Output does NOT constitute legal advice and should not be relied upon as a substitute for review by a qualified professional (including, where appropriate, qualified legal counsel) before being used, submitted to a regulator, relied upon for a compliance decision, or otherwise acted upon.

The Customer is solely responsible for reviewing, verifying, and approving any AI-Generated Output before relying on it or using it for any purpose, including regulatory submissions.

The Company disclaims all liability for decisions made, actions taken, or omissions arising from the Customer's use of, or reliance on, AI-Generated Output without independent review, to the maximum extent permitted by applicable law.

8. Termination

8.1 Termination for Convenience. Subject to any applicable minimum subscription term (Section 4.4), either party may terminate a subscription for convenience by providing notice prior to the next renewal date, as described in Section 4.4.

8.2 Termination for Cause. Either party may terminate these Terms with immediate effect by written notice if the other party materially breaches these Terms and, where the breach is capable of remedy, fails to remedy it within thirty (30) days of written notice describing the breach. The Company may suspend or terminate a Customer's access to the Platform with immediate effect, without liability, if: (a) the Customer fails to pay undisputed fees when due and does not remedy this within a reasonable cure period; (b) the Company reasonably believes the Customer's use of the Platform poses a security risk, legal risk, or violates applicable law; or (c) required to do so by law or a competent authority.

8.3 Effect of Termination. Upon termination, the Customer's right to access the Platform ceases. Sections that by their nature should survive termination (including Confidentiality, Data Protection, AI-Generated Output Disclaimer, Limitation of Liability, and Governing Law) will survive.

8.4 Business Cessation and Platform Discontinuation. In the event the Company permanently ceases operating the platform, undergoes a voluntary or involuntary liquidation, or discontinues the Services ("Business Cessation"): (a) Advance Notice — we will provide you with at least thirty (30) calendar days' prior written notice via the email address associated with your account or through a prominent notice on the Platform, unless prohibited from doing so by law or court order. (b) Data Export Window — during the thirty (30) day notice period, you will retain full access to export, download, and back up all generated reports, audit logs, AI inventories, Model Cards, and technical documentation stored within your workspace(s). (c) Service Termination & Data Deletion — upon the expiration of the notice period, all access to the Platform will terminate, and we reserve the right to securely delete or anonymize all stored workspace data, subject to applicable legal data retention obligations. (d) Pro-Rata Refund of Unused Fees — in the event of a Business Cessation initiated by us, we will provide a pro-rata refund for any pre-paid, unused portion of your active monthly or annual Subscription Plan fees, as well as any unexpired, purchased Top-Up Credit balances, calculated from the official date of service termination. (e) Limitation of Liability for Discontinuation — subject to providing the data export window and pro-rata refund as specified in this Section 8.4, we shall have no further liability, obligation, or penalty to you or any third party arising from or related to the discontinuation of the Services.

8.5 Force Majeure Event. The Company shall not be liable for failure or delay in performing its obligations under this Agreement due to a Force Majeure event, including but not limited to acts of God, natural disasters (e.g., floods, earthquakes), war, terrorism, government actions, labor strikes, pandemics, or any other event beyond the party's reasonable control. The Company must promptly notify the Customer of the Force Majeure event. If the Force Majeure event continues for more than thirty (30) days, either party may terminate the Agreement upon written notice.

9. Limitation of Liability

To the maximum extent permitted by applicable law, the Company's total aggregate liability arising out of or in connection with these Terms, whether in contract, tort, or otherwise, shall not exceed the total fees paid by the Customer to the Company in the twelve (12) months preceding the event giving rise to the claim.

To the maximum extent permitted by applicable law, neither party shall be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of profits, revenue, data, or business opportunity, arising out of or in connection with these Terms.

Nothing in these Terms limits or excludes either party's liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded under applicable law.

10. Changes to These Terms

The Company may update these Terms from time to time to reflect changes in the Service, legal or regulatory requirements, or business practices. The Company will provide access to new terms immediately through the platform. Continued use of the Platform after the effective date of updated Terms constitutes acceptance of those Terms.

11. Governing Law and Jurisdiction

These Terms are governed by the laws of Cyprus, where the Company is established, without regard to its conflict of laws principles. Any dispute arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of the courts of Cyprus, save that nothing in this clause shall deprive a consumer Customer of any mandatory protections afforded by the law of their country of habitual residence.

12. Intellectual Property Rights

12.1 Platform IP. The Company retains all right, title and interest in and to the Platform, underlying software architecture, design templates, algorithms, methodology, and documentation.

12.2 Generated Documents. Subject to full payment of applicable fees and credits, the Company grants the Customer a perpetual, non-exclusive, worldwide, royalty-free license to use, modify, export, reproduce, and distribute any generated reports, Model Cards, and technical documentation generated through the Customer's authorized account for Customer internal business or client advisory purposes.

13. Advertising

Neither the Company nor the Customer will, without prior written agreement, publish or use any advertising or promotional material that mentions or infers a relationship between the parties.

14. Electronic Approval

The Customer recognizes the electronic approval of the current document through the Platform, as legally valid and binding for entering into agreements, unless applicable law mandates any other form of execution.

15. Contact Information

Questions about these Terms, or requests relating to data protection, should be directed to: contact@u4ai.ai, Umbrella4AI Limited, Kypranoros 13, Nicosia, Cyprus.