Terms of Service

7.1 Prohibited Activities

• Engage in any unlawful activities or violate applicable laws or regulations
• Infringe upon intellectual property rights of any third party
• Transmit harmful, abusive, hateful, harassing, defamatory, or offensive content
• Distribute malware, viruses, or malicious code
• Interfere with, disrupt, or overload our services or systems
• Attempt to gain unauthorized access to our systems, networks, or accounts
• Use our services for competitive intelligence gathering or benchmarking
• Reverse engineer, decompile, or attempt to extract our proprietary algorithms or AI models
• Engage in data scraping, harvesting, or automated data collection
• Circumvent security measures, authentication mechanisms, or usage limits

7.2 AI-Specific Restrictions

• Attempt to manipulate, jailbreak, or circumvent AI safety mechanisms
• Use the AI to generate illegal, harmful, or prohibited content
• Feed the AI with sensitive personal data without proper authorization
• Use AI outputs for high-risk applications without human oversight
• Present AI-generated content as human-generated without disclosure

7.3 Enforcement

We reserve the right to investigate violations of this Acceptable Use Policy and take appropriate action, including suspension or termination of services, removal of content, and cooperation with law enforcement.

8.1 Availability

We strive to maintain 99.5% uptime for our services, measured monthly. Uptime excludes scheduled maintenance windows, which will be communicated at least 48 hours in advance when possible.

8.2 Support

• Email support: Response within 24 business hours
• Critical issues: Escalation procedures available for service outages
• Support hours: Monday-Friday, 9 AM - 6 PM CET

8.3 Service Modifications

We reserve the right to modify, suspend, or discontinue services with 30 days' notice for non-material changes. For material changes that significantly reduce functionality, we will provide 90 days' notice.

9.1 Data Ownership

You retain all ownership rights to your customer data, content, and any data you provide to our services. We claim no ownership rights over your data. Your data includes customer support conversations, knowledge base content, customer records, and any other information you input into our services.

9.2 Data Processing Agreement (DPA)

KarmaCX acts as a data processor (or service provider under CCPA) when processing personal data on your behalf. Our data processing terms include:

• We process personal data only on your documented instructions
• We maintain confidentiality of personal data
• We implement appropriate technical and organizational security measures (see Privacy Policy Section 7)
• We assist with data subject rights requests (GDPR Articles 15-22)
• We assist with data protection impact assessments when required
• We delete or return personal data upon termination (at your choice)
• We provide information necessary to demonstrate GDPR compliance
• We notify you of personal data breaches within 24 hours

9.3 Subprocessors

We engage third-party subprocessors to assist in providing our services (see Privacy Policy Section 5.1). We provide 30 days' notice before adding new subprocessors. You may object to a new subprocessor on reasonable grounds, in which case we will work with you to find an alternative solution or allow termination without penalty.

9.4 Your Responsibilities

You are responsible for:

• Ensuring you have lawful basis and authority to provide data to us
• Complying with applicable data protection laws regarding your use of our services
• Obtaining necessary consents from your end users
• Providing privacy notices to your end users about AI processing
• Not inputting data you do not have rights to process

9.5 AI Training and Model Improvement

Your data is NEVER used to train AI models for other customers. Our contracts with AI providers (OpenAI, Anthropic) include strict prohibitions on using your data for model training. Any insights or improvements derived from your data are used solely to improve your specific service instance.

11.1 Liability Cap

To the maximum extent permitted by law, KarmaCX's total aggregate liability arising out of or related to these Terms shall not exceed the amount paid by you to KarmaCX in the 12 months immediately preceding the event giving rise to the claim.

11.2 Exclusion of Consequential Damages

To the maximum extent permitted by law, KarmaCX shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including without limitation:

• Loss of profits, revenue, or business opportunities
• Loss of data or information (ensure you maintain backups)
• Loss of goodwill or reputation
• Cost of procurement of substitute services
• Business interruption or downtime costs

11.3 AI-Specific Limitations

We are not liable for:

• Inaccuracies, errors, or inappropriate content generated by AI systems
• Customer decisions based on AI-generated responses
• Failures of third-party AI providers (OpenAI, Anthropic)
• Consequences of AI responses you approved or deployed without review

You are responsible for implementing appropriate human oversight and review processes for AI outputs, especially in high-stakes or sensitive contexts.

11.4 Exceptions to Limitations (GDPR Compliance)

The above limitations do not apply to:

• Liability for death or personal injury caused by our negligence
• Liability for fraud or fraudulent misrepresentation
• Liability for gross negligence or willful misconduct
• Data protection violations under GDPR, CCPA, or other data protection laws (statutory liability applies)
• Any other liability that cannot be excluded or limited under applicable law

13.1 Termination Rights

• By You: Terminate at any time with 30 days' written notice
• By Us (for convenience): Terminate with 90 days' written notice
• By Us (for cause): Immediate termination for material breach, non-payment, or violation of Acceptable Use Policy

13.2 Effect of Termination

Upon termination:

• Your right to use our services ceases immediately
• You must pay any outstanding fees for services rendered
• We will provide you with access to export your data for 30 days post-termination
• At your election, we will either return or securely delete your personal data within 60 days
• We may retain limited data for legal, accounting, or regulatory compliance purposes

13.3 Data Deletion Certification

Upon request, we will provide written certification that your data has been securely deleted in accordance with industry standards and GDPR requirements. Deletion includes removal from all production systems, backups, and subprocessor systems.

13.4 Survival

Sections regarding intellectual property, confidentiality, limitation of liability, indemnification, and data processing obligations survive termination to the extent necessary to enforce their terms.

14.1 Our Warranties

We warrant that:

• We will provide the services with reasonable skill and care
• We maintain appropriate security measures as described in our Privacy Policy
• We comply with applicable data protection laws in our processing of personal data
• We have the right to provide the services and grant you the rights under these Terms

14.2 Disclaimers

EXCEPT AS EXPRESSLY PROVIDED IN THESE TERMS, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED. TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

We specifically do not warrant that:

• AI-generated responses will be accurate, appropriate, or error-free
• The services will meet your specific requirements
• The services will be uninterrupted, timely, or error-free
• Defects will be corrected within a specific timeframe

15.1 SOC 2 Type II

KarmaCX maintains SOC 2 Type II certification, audited annually by an independent third-party auditor. Our SOC 2 report covers security, availability, and confidentiality criteria. Current SOC 2 reports are available to customers under NDA upon request.

15.2 GDPR and Data Protection

We comply with GDPR, CCPA/CPRA, and other applicable data protection regulations. Our data processing activities are documented in accordance with GDPR Article 30, and we maintain appropriate technical and organizational measures as required by GDPR Article 32.

15.3 HIPAA Business Associate

For customers processing Protected Health Information (PHI), we enter into a separate HIPAA Business Associate Agreement and implement all required HIPAA Security Rule safeguards. Contact us to request a BAA.

15.4 EU AI Act Compliance

Our AI systems are classified as limited-risk under the EU AI Act. We implement transparency obligations including disclosure of AI use, accuracy limitations, and human oversight capabilities. We maintain technical documentation and quality management systems as required by the EU AI Act.

17.1 Governing Law

These Terms are governed by the laws of Cyprus, without regard to its conflict of law provisions. For customers located in the EU, mandatory consumer protection laws of your country of residence may also apply.

17.2 Dispute Resolution

Any disputes arising from these Terms shall be resolved through good faith negotiations. If negotiations fail, disputes shall be resolved in the competent courts of Cyprus. EU customers may also have the right to bring disputes in the courts of their country of residence.

17.3 Severability

If any provision of these Terms is found invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect. Invalid provisions shall be modified to the minimum extent necessary to make them valid and enforceable.