YouCraft Licence and Services Agreement

These General Terms and Conditions govern the Customer’s access to YouCraft, the Supplier’s SaaS platform, together with the related onboarding and support. They do not contain their own signature block: they apply to, and are incorporated into, each Order Form that refers to them, and are accepted when the Customer’s authorised representative signs that Order Form. By signing the Order Form and ticking the relevant box, the Customer confirms that it has read, understood and accepted these General Terms and Conditions, as well as the plan, price, number of Licences and term specified in that Order Form. The Customer further confirms that it is acting exclusively for professional purposes.

Order of precedence. In the event of conflict: (i) the General Terms and Conditions (where applicable), (ii) the DPA in respect of the Processing of Customer Personal Data, (iii) the Order Form, but only to the extent that it expressly states that it derogates from these General Terms and Conditions, (iv) these General Terms and Conditions, and then (v) the other Schedules.

1. Definitions

“Affiliate” means any entity that controls, is controlled by, or is under common control with, a party.

“Agreement” means these General Terms and Conditions, the applicable Order Form and the Schedules (including the DPA).

“Applicable Data Protection Laws” means Regulation (EU) 2016/679 (the “GDPR”), the national laws implementing or supplementing it and, where applicable, the UK GDPR and Swiss data protection legislation.

“Applications” means the applications, agents, dashboards and automations developed or deployed using the Platform.

“Conversation Data” means the prompts, instructions, inputs, Generated Outputs and conversation history exchanged through the features of the Platform.

“Credits” means the monthly usage allowance included in a plan.

“Customer Data” means all data, content and documents that the Customer or its users submit to the Platform or generate within it, including Conversation Data and the code of the Applications.

“Customer Personal Data” means the Personal Data contained in the Customer Data and Processed by the Supplier on behalf of the Customer.

“Documentation” means the Supplier’s user guides and technical documentation in force from time to time.

“DPA” means the data processing agreement set out in Schedule C, as updated to the extent required by Applicable Data Protection Laws.

“Supplier Environment” and “Customer Environment” mean, respectively, the infrastructure operated or controlled by the Supplier (or its suppliers) and the infrastructure operated or controlled by the Customer, in which an Application may be hosted.

“Licence” means a named subscription to the Platform, corresponding to the plan specified in the Order Form (Starter, Business, Sovereign or Enterprise); “Reader Licence” means a licence permitting the use of published Applications without creating or modifying them (Schedule A).

“Open Source Components” means the third-party software components integrated into the Platform, governed by their own licence terms.

“Order Form” means the signed document confirming the plan(s), the number of Licences, the price and the start date, including the Order Form relating to the free trial referred to in Article 5.1.

“Generated Outputs” means the text, code, analyses or any other content generated by the Platform or by a Third-Party AI Model from the prompts, instructions or Customer Data provided.

“Platform” or “YouCraft” means the Supplier’s SaaS platform for designing and deploying Applications.

“Services” means access to the Platform together with the onboarding, support and any professional services provided under the Agreement.

“Bespoke Developments” means any bespoke configuration, connector, workflow, integration or customisation developed by the Supplier specifically for the Customer.

“Sub-processor” means any third party engaged by the Supplier to Process Customer Personal Data, including providers of Third-Party AI Models.

“Third-Party AI Model” means a large language model or other generative AI model provided by a third party (currently including Scaleway) on which the Platform relies.

“Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject” and “Personal Data Breach” have the meanings given to them in the GDPR.

2. Licence and permitted use

2.1Subject to payment of the fees provided for in the Agreement and compliance with its provisions, the Supplier grants the Customer a non-exclusive, non-transferable and non-sub-licensable right, for the term of the Agreement, to access and use the Platform for its own business purposes, within the limits of the number of Licences and the plan specified in the Order Form and, for those plans that permit it, to make its Applications available to its own customers or to the public.

2.2Licences are named and personal; they must not be shared but may be reassigned upon notice to the Supplier. A published Application may be shared with unlicensed users, who may neither modify it nor collaborate on the underlying project. The Customer is responsible for its users’ compliance with the Agreement and for the security of their credentials.

2.3The Supplier retains all rights in the Platform (software, models, templates, Documentation and improvements). Nothing in the Agreement transfers any such rights to the Customer.

2.4The Platform is intended for professional use only. The Customer shall not: (a) resell, sub-license, rent or redistribute the Platform; (b) use the Platform or the Generated Outputs to develop or train a competing AI product or model; (c) reverse engineer, decompile or attempt to extract source code that is not made available to it; (d) circumvent any technical, security, usage or Credit restriction; or (e) use the Platform in breach of Article 7.

2.5The Supplier may update the Platform and may replace or cease to offer Third-Party AI Models, Open Source Components, hosting providers or features, provided that it does not materially reduce the essential functionality of the Customer’s plan. The Supplier may verify compliance with the terms of the Licence.

3. Third-Party AI Models, Open Source Components and Bespoke Developments

3.1The Supplier is not the developer of the Third-Party AI Models and does not control their availability, behaviour or performance. The licence granted to the Customer relates solely to YouCraft and not to the underlying model, and the Customer has no direct right against the model provider. The Agreement does not constitute a licence, sub-licence or resale of the services of any provider. The Customer shall not present YouCraft or any Application as an official product of, or as endorsed by, a model provider, and shall comply with the model providers’ usage policies made available in the Documentation.

3.2Open Source Components remain governed by their own licences. The Supplier is not responsible for the Customer’s compliance with those licences if the Customer extracts a component and reuses it outside the Platform.

3.3Bespoke Developments remain the property of the Supplier unless assigned in writing; the Customer may use them for the term of the Agreement. The Supplier may reuse the general ideas, methods, components and know-how arising from them, without disclosing the Customer’s Confidential Information.

4. Fees, Credits and payment

4.1The fees are those set out in the Order Form and Schedule A, exclusive of VAT and other taxes. Each plan includes a monthly allowance of Credits; unused Credits are not carried forward unless the Order Form provides otherwise, and additional Credits may be purchased at standard rates. Anything outside the plan (additional Credits, bespoke connectors, set-up of self-hosting, professional services, additional support) is quoted and invoiced separately.

4.2The Supplier invoices monthly in advance, on the basis of active Licences. Invoices are payable within 30 days of the invoice date, without set-off or deduction.

4.3Any sum not paid when due bears late-payment interest at three times the legal rate of interest and gives rise to a fixed indemnity of €40 for recovery costs (in France, Articles L.441-10 and D.441-5 of the French Commercial Code), without prejudice to the Supplier’s right to claim additional recovery costs. If an undisputed invoice remains unpaid 15 days after a reminder, the Supplier may suspend access until payment is made.

4.4The Supplier may change its prices or the content of the plans on at least 30 days’ written notice, with effect from the next billing period; the Customer may terminate by notice before the change takes effect.

4.5Licences may be added by email to the Supplier’s contact set out in Schedule B; the Supplier will confirm in writing and invoice the additional Licences pro rata from their activation, without a new Order Form being required. Reductions or changes of plan take effect from the next billing period, unless the Supplier agrees otherwise. For the Enterprise plan, no reduction in the number of Licences and no downgrade to a lower plan may take effect before the end of the current twelve (12)-month period; additions of Licences remain possible at any time and are invoiced pro rata until the end of that period.

5. Term, trial period, termination and exit

5.1Trial period. The trial period is the subject of a separate trial Order Form. It is free of charge, relates to the Business plan and lasts two (2) weeks, renewable by written agreement of the parties. At the end of the trial period, the Customer may subscribe to the plan of its choice (Starter, Business, Sovereign or Enterprise) by signing a new Order Form specifying the plan, the number of Licences, the price and the start date. These General Terms and Conditions, in the version in force on the date of signature of the first Order Form, apply to all Order Forms subsequently entered into. If no new Order Form is signed at the end of the trial period, access will end and no fees will be due in that respect. The trial period is provided “as is” and the Supplier may limit its scope.

5.2Term. The Agreement continues for an indefinite period. Either party may terminate it at any time by giving not less than three (3) months’ written notice, sent by registered letter with acknowledgement of receipt. Fees remain payable until the end of the notice period.

5.3Termination for breach. Either party may terminate the Agreement if the other party commits a material breach which is not remedied within 30 days of written notice, or if, subject to mandatory insolvency laws, it becomes insolvent.

5.4Suspension and immediate termination. The Supplier may suspend access, in whole or in part, or terminate the Agreement without notice and without compensation, in the event of: a material breach of Articles 2.4, 7 or 6.6; non-payment under Article 4.3; a threat to the security or integrity of the Platform or of other customers; an order from a competent authority; or suspension or withdrawal of service by a Third-Party AI Model provider by reason of the Customer’s use. Where possible, the Supplier will give notice, limit the suspension to what is necessary and lift it once the cause has been remedied. This does not affect fees already due or the Supplier’s other rights.

5.5Effects. On termination or expiry, access to the Platform ends. The Customer may export its source code and the Customer Data during the thirty (30)-day period following termination, where that functionality is available in its plan; the Supplier will then return or delete the Customer Data in accordance with Schedule C. Accrued fees remain payable. Where the mandatory switching rules of Regulation (EU) 2023/2854 (the Data Act) apply to the Services, the Supplier will comply with them and they shall prevail over any contrary provision of the Agreement.

5.6Discontinuation of the Platform. If the Supplier permanently ceases to operate YouCraft, it will give at least ninety (90) days’ written notice, assist the Customer in exporting its source code and Customer Data, and refund fees paid in advance for the period after the closure date.

5.7Enterprise plan – price changes. At least one hundred and twenty (120) days before the end of each period, the Supplier will send the Customer a renewal reminder stating, where applicable, the new prices applicable for the following period. If that reminder is not sent within that time, the Agreement will be renewed at the prices applicable during the period then ending.

6. Data protection, security and hosting

6.1Roles. For Customer Personal Data, the Customer is Controller and the Supplier is Processor, in accordance with the DPA. The Supplier acts as an independent Controller for the account and authentication data of the Customer’s users, billing data, security and technical logs, and usage and service metadata, which it Processes for the purposes of account management, billing, security, prevention of fraud and abuse, service reliability and compliance with legal obligations, in accordance with its privacy policy.

6.2Hosting. Customer Data is hosted on cloud infrastructure located in the European Union and logically segregated by Application. The Sovereign and Enterprise plans may be self-hosted or deployed under a data residency arrangement agreed in writing. Where the Customer uses an AI feature, the relevant Customer Data (including prompts, inputs and Generated Outputs) may be transmitted to the corresponding Third-Party AI Model provider (Scaleway) and is Processed in accordance with the DPA and its list of Sub-processors, which may involve transfers outside the EU subject to appropriate safeguards. EU hosting applies to the Supplier Environment and does not, of itself, guarantee that an enabled Third-Party AI Model provider will not Process data outside the EU, unless expressly agreed in writing for a specific Sovereign, Enterprise or self-hosted deployment.

6.3No training. The Supplier shall not use Customer Data to train its own models. From the Business plan upwards, the Supplier operates a Zero Data Retention regime for AI processing, to the extent that the contractual commitments of the Third-Party AI Model providers towards it enable it to guarantee this (not included in Starter). Customer Personal Data is subject to Article 9 of the DPA.

6.4Security. The Supplier implements the measures set out in Appendix 2 to the DPA and runs automated security scans on each deployment. From Business upwards, audit logs are included; Enterprise adds penetration testing; Sovereign adds confidential data blockers. The Customer shall notify the Supplier without delay of any security incident, unauthorised access or compromise of credentials of which it becomes aware.

6.5Customer responsibilities. The Customer is solely responsible for: the lawfulness of the Customer Data and of its instructions; having a valid legal basis and providing Data Subjects (including the users of its Applications) with the required information; handling requests from Data Subjects addressed to it; its own internal rules on the use of AI; the security of any Customer Environment; and keeping independent backups of the Customer Data and source code that are critical to its business.

6.6Prohibited data. Unless otherwise agreed in writing by the Supplier and appropriate additional safeguards are put in place, the Customer shall not submit: special categories of Personal Data (Article 9 GDPR, for example health, biometric or genetic data); data relating to criminal convictions or offences; data of minors; highly sensitive trade secrets or classified information; full payment card or bank identifiers; passwords, API keys or other technical secrets; or third-party documents that it is not authorised to process with an AI tool. The Supplier is not responsible for the consequences of a breach of this Article.

7. Acceptable use and AI regulation

7.1The Customer shall not use the Platform or any Application to: break the law or conceal a breach of the law; infringe the rights of third parties; generate hateful, discriminatory, defamatory or violent content or content constituting harassment; carry out unlawful surveillance or profiling; produce malicious code or phishing content, circumvent security controls or obtain unauthorised access to systems; or falsify documents, manipulate evidence or facilitate fraud, corruption or money laundering.

7.2Unless otherwise agreed in writing, the Customer shall not use the Platform to make or automate decisions producing legal effects or similarly significant effects on natural persons (Article 22 GDPR), in particular in relation to recruitment, HR management, credit, insurance, health, justice, scoring of individuals or access to essential services.

7.3As provider and/or deployer of the Applications that it develops, deploys or makes available, the Customer is solely responsible for determining their classification and for complying with Regulation (EU) 2024/1689 (the “AI Act”) to the extent applicable, including the prohibition of certain practices and the requirements of transparency, human oversight and AI literacy. The Supplier provides reasonable Documentation to assist it in doing so.

7.4The Supplier may remove or suspend any Application or content that infringes this Article 7, and may cooperate with the competent authorities.

8. Intellectual property, Generated Outputs and professional judgement

8.1The Supplier owns the Platform, its improvements, the Bespoke Developments and the Documentation. The Customer grants the Supplier a royalty-free licence to use any feedback or suggestions that it provides. The Supplier may use aggregated and anonymised usage and performance statistics that do not identify the Customer, its users or any Data Subject and that do not include the content of the Customer Data.

8.2The Customer owns its Customer Data. From the Business plan upwards, the Customer may download the source code of its Applications and synchronise it with its own repository, and owns the Applications and code that it develops, subject to the Supplier’s underlying rights in the Platform, the Open Source Components and the third-party terms set out in the Documentation. Starter does not include code download; Applications remain usable via the Platform for as long as the subscription is in force. The Customer grants the Supplier a limited, non-exclusive licence to host, Process, transmit (including to Sub-processors) and display the Customer Data, solely for the purposes of providing the Services and complying with the law.

8.3Subject to the rights of third parties and those of the Supplier and of the providers of Open Source Components and Third-Party AI Models, the Customer may use the Generated Outputs for its business purposes. Generated Outputs are not necessarily unique: similar prompts may produce similar Generated Outputs for other persons.

8.4Generated Outputs may be inaccurate, incomplete, out of date, biased or unsuitable. The Customer shall verify them before relying on them, ensure human review before use, not base any important decision solely on a Generated Output, have Generated Outputs checked by a qualified person where the stakes are legal, tax, financial, technical, HR, medical, regulatory or strategic, and inform its own users of these limitations. YouCraft is a technology tool and not a professional adviser; the Customer remains solely responsible for decisions taken with its assistance.

9. Confidentiality

9.1“Confidential Information” means any non-public information, in any form, disclosed by one party (the “Disclosing Party”) to the other (the “Receiving Party”) in connection with the Agreement, which is marked as confidential or would reasonably be considered to be so. It includes: for the Customer, the Customer Data, the Applications and their source code, prompts, Generated Outputs, credentials and business information; for the Supplier, the non-public aspects of the Platform (architecture, source code, system prompts, model configurations, templates, security measures, test results, roadmap), the Bespoke Developments and the prices; and, for both, the terms of the Agreement.

9.2The following are excluded: information that the Receiving Party can demonstrate: is or becomes public other than as a result of a breach by it; was lawfully known to it beforehand; was lawfully received from a third party entitled to disclose it; or was independently developed without use of the Disclosing Party’s Confidential Information.

9.3The Receiving Party shall use Confidential Information solely to perform the Agreement or exercise its rights under it, shall protect it with at least reasonable care, and shall disclose it, on a need-to-know basis, only to its personnel, its Affiliates and its professional advisers who are bound by equivalent confidentiality obligations. The Supplier may also disclose the Customer’s Confidential Information to its subcontractors and Sub-processors (including hosting providers and providers of Third-Party AI Models) only to the extent necessary for the provision of the Services and subject to written confidentiality terms; such disclosure under the DPA does not constitute a breach. The Receiving Party remains liable for the persons to whom it discloses it.

9.4The Receiving Party may disclose Confidential Information where required by law or by a competent authority, after prior notice to the Disclosing Party where the law permits, and only to the extent necessary. It shall notify the Disclosing Party without undue delay of any unauthorised disclosure or use of which it becomes aware.

9.5On termination, or on request, the Receiving Party shall return or delete the Disclosing Party’s Confidential Information (Customer Data being governed by Article 5.5 and Schedule C), except for copies required by law or retained in routine backups until overwritten, which shall remain confidential.

9.6These obligations apply during the term of the Agreement and for five (5) years after its end, and without limit of time for trade secrets (for as long as they are protected as such) and for Customer Data held by the Supplier or its Sub-processors. No licence is granted over Confidential Information, and the Disclosing Party may seek urgent interim relief in addition to its other remedies.

10. Support and maintenance

10.1The Supplier provides onboarding (of approximately one hour), initial training, hands-on assistance for the first Application and periodic follow-up meetings (approximately every two weeks) during the initial period, as set out in the onboarding plan. Standard support is provided by email/ticketing system during business hours. The Enterprise plan includes a dedicated Customer Success Manager and solutions architect, any service levels being defined in a separate SLA.

10.2The Supplier uses reasonable endeavours to keep the Platform available, does not guarantee uninterrupted service and gives notice of planned maintenance where possible. Confirmed defects reported to support will be examined and corrected using reasonable endeavours within a reasonable time, prioritised by severity, unless an Enterprise SLA provides otherwise.

11. Warranties, liability and indemnification

11.1Each party warrants that it has the power to enter into the Agreement. The Supplier provides the Platform with reasonable skill and care, in accordance with the Documentation. The Supplier’s obligations under the Agreement are obligations of means only (best endeavours).

11.2To the extent permitted by law, the Platform is provided “as is”. The Supplier does not warrant that the Platform will be error-free, uninterrupted or suitable for all uses, nor the accuracy, completeness or suitability of Generated Outputs, the continued availability of any Third-Party AI Model, the absence of vulnerabilities in the Open Source Components, or the suitability of any given Application for the Customer’s purpose. The Customer shall test and validate anything that is business-critical or regulated before relying on it.

11.3Nothing in the Agreement limits or excludes liability for death or personal injury, fraud, wilful misconduct or gross negligence, or any liability that cannot be limited or excluded under applicable law.

11.4Subject to Article 11.3, neither party is liable to the other for loss of profit, revenue, data, contracts, customers or goodwill, damage to reputation or any other indirect or consequential loss, nor, as regards the Supplier, for the consequences of a decision based on a Generated Output that has not been verified in accordance with Article 8.4.

11.5Subject to Article 11.3, the Supplier’s total aggregate liability arising out of or in connection with the Agreement, including the DPA to the extent permitted by Applicable Data Protection Laws, for all claims in any period of twelve (12) months, is limited to the fees paid by the Customer to the Supplier in the twelve (12) months preceding the event giving rise to the claim. This limit does not apply to the Customer’s payment obligations. Any claim must be brought within one (1) year of the event giving rise to it.

11.6The Customer shall indemnify and hold harmless the Supplier against any third-party claim, and against the resulting fines, damages and reasonable costs, arising from: (a) Customer Data or Applications infringing third-party rights or being subject to unlawful Processing; (b) the Customer’s breach of Articles 2.4, 6.5, 6.6 or 7, of Applicable Data Protection Laws or of the AI Act; or (c) the Customer’s unlawful instructions; except to the extent caused by a breach of the Agreement, the DPA or Applicable Data Protection Laws by the Supplier or its Sub-processors. The Supplier shall notify the Customer of the claim without delay, allow the Customer to control the defence (without any admission of liability on behalf of the Supplier) and cooperate reasonably at the Customer’s expense.

11.7The parties acknowledge that the fees reflect this allocation of risk.

12. Compliance and publicity

12.1Each party shall comply with the laws applicable to it, including rules on data protection, anti-corruption, export control and sanctions. The Customer shall not use the Platform or make it available in breach of applicable sanctions or export restrictions.

12.2The Customer shall not use the names, logos or distinctive signs of the Supplier, YouCraft or any Third-Party AI Model provider () in its public, commercial or promotional communications without prior written consent. The Supplier may cite the Customer’s name and logo as a reference, unless the Customer objects in writing.

13. General provisions

13.1Assignment. The Customer may not assign the Agreement without the Supplier’s consent. The Supplier may assign it to an Affiliate or in connection with a merger or sale of its business, on notice to the Customer.

13.2Force majeure. Neither party is liable for any delay or failure caused by an event beyond its reasonable control, including a large-scale outage, cyber-attack, network failure, unavailability of a critical supplier, a restriction imposed by a Third-Party AI Model provider, or a change in law or regulation.

13.3Entire agreement; severability. The Agreement constitutes the entire agreement between the parties on its subject matter and supersedes prior discussions. If any provision is invalid, the remainder continues in force. Failure to enforce a right does not constitute a waiver.

13.4Amendments. Any amendment must be made in writing and agreed by both parties, except for changes to prices and plans (Article 4.4), updates to the DPA and changes of Sub-processors (Schedule C), and technical, security or regulatory access conditions, or those required by a Third-Party AI Model provider, which do not materially reduce the Customer’s essential rights, on at least 30 days’ notice. If an amendment materially and adversely affects the Customer, the Customer may terminate by written notice within that period.

13.5Notices. Notices shall be sent to the contacts specified in the Order Form or in Schedule B. Notices of termination must be sent by registered letter with acknowledgement of receipt (Articles 5.2 and 5.7).

13.6Electronic signature. The Order Form may be signed electronically, including by means of a recognised electronic signature platform (Regulation (EU) No 910/2014 “eIDAS” or equivalent local law); the parties agree that it shall have the same legal effect as a handwritten signature.

13.7Governing law and jurisdiction. The Agreement is governed by French law. The courts of Paris have exclusive jurisdiction, without prejudice to mandatory provisions.

13.8Survival. Articles 5.5, 8, 9, 11, 12 and 13, and any provision intended to survive, continue to apply after the end of the Agreement.

Acceptance. These General Terms and Conditions do not contain their own signature block. They are accepted when an authorised representative of the Customer signs the Order Form that refers to them and electronically accepts these General Terms and Conditions and their schedules by ticking the box provided for that purpose.