General Terms and Conditions

These General Terms govern Customer’s access to the YouCraft SaaS Platform and related onboarding and support. They have no separate signature block. They are incorporated into, and accepted upon signature of, an Order Form that clearly identifies the applicable dated version and provides accessible links to these General Terms and the DPA included in these General Terms. By signing, Customer confirms that it acts solely for business purposes and accepts the plan, price, License count and term specified in the Order Form.

Order of precedence. In the event of a conflict: (i) the DPA with respect to Processing of Customer Personal Data; (ii) the Order Form, but only to the extent it expressly derogates from these General Terms; (iii) these General Terms; and (iv) any other schedules expressly incorporated into the Agreement. Any mandatory provisions of applicable law prevail.

1. Definitions

Affiliate - An entity controlling, controlled by or under common control with a party.

Agreement - These General Terms, applicable Order Form and schedules, including the incorporated DPA.

Applicable Data Protection Laws - The Canadian federal and provincial privacy, data protection, data security and breach notification laws applicable to the Processing, including PIPEDA, Québec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), and applicable Alberta and British Columbia private-sector privacy statutes.

Applications - Applications, agents, dashboards and automations developed or deployed using the Platform.

Conversation Data - Prompts, instructions, inputs, Generated Outputs and conversation history exchanged through Platform features.

Credits - The monthly usage allowance included in a plan.

Custom Developments - Custom configuration, connector, workflow, integration or customization developed specifically for Customer.

Customer Data - All data, content and documents submitted or generated by Customer or its users in the Platform, including Conversation Data and Application code.

Customer Personal Data - Personal Data within Customer Data processed by Provider on Customer’s behalf.

Documentation - Provider’s then-current user guides and technical documentation.

DPA - The data processing addendum included below in these General Terms, as updated to the extent required by Applicable Data Protection Laws.

Generated Outputs - Text, code, analysis or other content generated from prompts, instructions or Customer Data by the Platform or Third-Party AI Models.

License - A named subscription to the Platform for the plan in the Order Form (Starter, Business, Sovereign or Enterprise).

Open-Source Components - Third-party software subject to their respective open-source licenses.

Order Form - Signed document identifying plan(s), License counts, price and commencement, including a trial Order Form.

Platform/YouCraft - Provider’s SaaS platform for designing and deploying Applications.

Provider Environment/Customer Environment - Infrastructure operated or controlled respectively by Provider (or suppliers)/Customer in which an Application may be hosted.

Services - Platform access, onboarding, support and other agreed professional services.

Subprocessor - Third party engaged to process Customer Personal Data, including Third-Party AI Model providers.

Third-Party AI Model - A large language model or another generative AI model supplied by a third party (as identified in the applicable Subprocessor list) on which the Platform relies.

Viewer License - A license to use published Applications without creating or modifying them.

“Personal Data,” “Processing,” “Controller,” “Processor,” “Business,” “Service Provider,” “Consumer,” have the meanings assigned under Applicable Data Protection Laws, as applicable. “Personal Data Breach” means an actual unauthorized acquisition of, access to, or disclosure of Customer Personal Data, or an actual loss of Customer Personal Data, compromising its security or confidentiality. Mere unsuccessful attempts to access data do not constitute a Personal Data Breach.

2. License and Permitted Use

2.1Subject to payment and compliance, Provider grants Customer a nonexclusive, nontransferable, nonsublicensable right during the Agreement to access and use the Platform for its own business purposes, within the plan and License limits in the Order Form, and, for eligible plans, make Applications available to its customers or the public.

2.2Licenses are named and personal, may not be shared, and may be reassigned on notice. Online Applications may be shared with unlicensed users, who may not edit or collaborate on the underlying project. Customer is responsible for its users’ compliance and credentials.

2.3Provider retains all rights in the Platform, software, models, templates, Documentation and improvements; no rights are transferred to Customer.

2.4The Platform is for professional use only. Customer shall not (a) resell, sublicense, rent or redistribute the Platform; (b) use the Platform or Generated Outputs to develop or train a competing AI product/model; (c) reverse engineer or attempt to extract undisclosed source code; (d) circumvent technical, security, usage or Credit restrictions; or (e) violate Section 7 of the Agreement.

2.5Provider may evolve the Platform and replace or discontinue Third-Party AI Models, Open-Source Components, hosting providers or features, provided that the core functionality of Customer’s plan is not materially reduced. Provider may verify License compliance.

3. Third-Party AI Models, Open Source and Custom Developments

3.1Provider does not develop Third-Party AI Models and does not control their availability, behavior or performance. Customer’s license covers YouCraft only, not underlying models, and grants no direct claim against model suppliers. This Agreement does not license, sublicense or resell a supplier’s services. Customer shall not suggest that YouCraft or its Applications are official or endorsed by a model supplier and shall comply with supplier usage policies made available in the Documentation.

3.2Open-Source Components remain subject to their own licenses. Provider is not responsible for Customer’s compliance when Customer extracts and reuses such components outside the Platform.

3.3Custom Developments belong to Provider absent written assignment; Customer may use them during the Agreement. Provider may reuse general ideas, methods, components and know-how without disclosing Customer Confidential Information.

4. Fees, Credits and Payment

4.1Fees are specified in the Order Form, exclusive of applicable GST/HST, QST, PST and other applicable indirect taxes. Each plan includes monthly Credits; unused Credits do not carry forward unless the Order Form says otherwise. Additional Credits may be purchased at standard rates. Items outside the plan (extra Credits, custom connectors, self-hosting setup, professional services and enhanced support) are separately quoted and invoiced.

4.2Provider invoices on the (1st) first day of the calendar month preceding the Start Date for active Licenses, unless the Enterprise Order Form expressly provides otherwise. Payment is due no later than the fifth (5th) day of the calendar month following the month of invoice, except as prohibited by law.

4.3Amounts unpaid by the due date as set forth in Section 4.2 of the Agreement shall accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law, without prejudice to Provider’s right to recover reasonable collection costs to the extent permitted by law. If an undisputed invoice remains unpaid fifteen (15) days after a reminder, Provider may suspend access until payment.

4.4Provider may modify prices or plan content with at least thirty (30) days’ written notice, effective with the next applicable billing period; Customer may terminate by written notice via email before the change takes effect, subject to any Enterprise fixed-term pricing commitment.

4.5Licenses may be added by email to the Provider’s designated contact; Provider confirms in writing and bills prorated fees from activation without a new Order Form. Reductions or plan changes take effect at the next billing period unless otherwise agreed. Enterprise License reductions or downgrades cannot take effect before the end of the current twelve (12)-month term; additions are prorated through that term.

5. Term, Trial, Termination and Exit

5.1Trial. A separate trial Order Form covers a free two (2)-week Business-plan trial, renewable by written agreement. After the trial, Customer may subscribe to Starter, Business, Sovereign or Enterprise only by signing a new Order Form identifying plan, License count, price and start date. No automatic paid conversion occurs. Unless expressly superseded, the General Terms version identified in the first Order Form governs successive Order Forms, subject to lawful written amendments. Without a new Order Form, access ends and no trial fee is due. The trial is provided AS IS and may have limited functionality.

5.2Term. Except for Enterprise subscriptions subject to the twelve (12)-month commitment specified in the applicable Order Form, the Agreement continues for an indefinite term. Either party may terminate at any time by providing at least three (3) months’ written notice delivered under Section 13.5 of this Agreement. Fees remain due through the notice period.

5.3Breach. Either party may terminate for material breach not cured within thirty (30) days after written notice, or insolvency subject to applicable mandatory insolvency law.

5.4Immediate suspension/termination. Provider may suspend all or part of access or terminate without prior notice or compensation for material breach of Sections 2.4, 7 or 6.6; nonpayment under Section 4.3; threats to security or other customers; binding government orders; or model-provider suspension caused by Customer’s use. Where practicable Provider gives notice, limits suspension to what is necessary and restores access after cure. Accrued fees and other rights survive.

5.5Effects. At termination or expiration, access to the Platform ends. Customer may export its source code and Customer Data during the thirty (30) days following termination where the functionality is available under its plan; Provider thereafter returns or deletes Customer Data under the DPA. Accrued fees remain payable.

5.6Platform discontinuation. If Provider permanently discontinues YouCraft, it provides at least ninety (90) days’ written notice, assists with export of source code and Customer Data and refunds prepaid fees attributable to periods after discontinuation.

5.7Enterprise price changes. At least one hundred twenty (120) days before the end of each Enterprise term, Provider sends a renewal reminder with any revised pricing. If Provider fails to do so, renewal occurs at the expiring term’s prices, subject to the renewal mechanics stated in the Enterprise Order Form.

6. Data Protection, Security and Hosting

6.1Roles. For Customer Personal Data, Customer is the Controller or Business and Provider is the Processor or Service Provider, as applicable, under the DPA. Provider acts independently as a Controller or Business for Customer user account and authentication data, billing information, security and technical logs, and usage and service metadata, which it processes for account administration, billing, security, fraud and abuse prevention, service reliability and legal compliance under its privacy notice.

6.2Hosting and Cross-Border Processing. Customer Data is hosted on cloud infrastructure located in the hosting region(s) identified in the Order Form or DPA Appendix 1 and logically segregated by Application. Sovereign and Enterprise plans may be self-hosted or deployed under a data-residency arrangement agreed in writing. When Customer uses AI features, relevant Customer Data (including prompts, inputs and Generated Outputs) may be transmitted to the applicable Third-Party AI Model providers in accordance with the DPA and its Subprocessor list. Processing of Customer Personal Data, including access by Third-Party AI Model providers, is subject to the agreed data residency and cross-border processing requirements in Section 8 of the DPA.

6.3No training. Provider shall not use Customer Data to train its own models. Beginning with the Business plan, Provider operates under a Zero Data Retention regime for AI processing to the extent that the contractual commitments of Third-Party AI Model providers permit Provider to guarantee it (not included in Starter). Customer Personal Data is subject to Section 9 of the DPA.

6.4Security. Provider implements the measures in DPA Appendix 2 and automated security scanning at deployment. Business includes audit logs; Enterprise adds penetration testing; Sovereign adds confidential data blocking. Customer shall promptly report known security incidents, unauthorized access or credential compromise.

6.5Customer responsibilities. Customer alone is responsible for lawful Customer Data and instructions, required legal bases and notices to individuals (including Application users), handling data-subject requests, its internal AI rules, Customer Environment security and independent backups of business-critical Customer Data and source code.

6.6Restricted data. Absent Provider’s written approval and appropriate additional safeguards, Customer shall not submit sensitive personal data (including health, biometric or genetic data), criminal-history data, children’s data, highly sensitive trade secrets or classified information, complete payment card or banking credentials, passwords, API keys or other secrets, or third-party documents it lacks authority to process with AI. Provider is not liable for consequences of Customer’s breach of this Section, to the extent permitted by law.

7. Acceptable Use and AI Regulation

7.1Customer shall not use the Platform or Applications to violate or conceal violations of law; infringe third-party rights; create hateful, discriminatory, defamatory, violent or harassing content; conduct unlawful surveillance or profiling; generate malware or phishing, bypass security or obtain unauthorized access; falsify records or evidence; or facilitate fraud, bribery or money laundering.

7.2Unless otherwise agreed in writing, Customer shall not use the Platform to make or automate decisions producing legal or similarly significant effects on individuals, including decisions concerning employment, HR, credit, insurance, healthcare, judicial matters, individual scoring or access to essential services.

7.3As the developer, provider or deployer of Applications it creates, deploys or makes available, Customer alone is responsible for classifying its Applications and complying with applicable Canadian federal and provincial laws governing artificial intelligence, automated decision-making, consumer protection, discrimination, privacy and transparency, including any applicable requirements for human oversight and AI governance. Provider shall supply reasonable Documentation to assist Customer.

7.4Provider may remove or suspend Applications or content that breach this Section and cooperate with competent authorities.

8. Intellectual Property, Generated Outputs and Professional Judgment

8.1Provider owns the Platform, improvements, Custom Developments and Documentation. Customer grants Provider a royalty-free license to use feedback and suggestions. Provider may use aggregated, anonymized usage/performance statistics that identify neither Customer, its users nor any individual and exclude Customer Data content.

8.2Customer owns Customer Data. From Business onward, Customer may download Application source code and sync it to its own repository, and owns Applications and code it develops, subject to Provider’s underlying Platform rights, Open-Source Components and third-party terms in Documentation. Starter does not include code download; Applications remain usable through the Platform during subscription. Customer grants Provider a limited nonexclusive license to host, process, transmit (including to Subprocessors) and display Customer Data only to provide Services and comply with law.

8.3Subject to third-party rights and Provider, Open-Source Component and Third-Party AI Model supplier rights, Customer may use Generated Outputs for business purposes. Generated Outputs may not be unique; similar prompts may yield similar outputs for others.

8.4Generated Outputs may be inaccurate, incomplete, outdated, biased or unsuitable. Customer shall review them before relying on them, apply human review before use, avoid basing significant decisions solely on Generated Outputs, obtain qualified review for legal, tax, financial, technical, HR, medical, regulatory or strategic matters, and inform its users of these limitations. YouCraft is a technology tool, not a professional adviser; Customer remains responsible for decisions made using it.

9. Confidentiality

9.1Confidential Information means nonpublic information disclosed in connection with the Agreement that is marked confidential or reasonably should be understood as such. Customer Confidential Information includes Customer Data, Applications, source code, prompts, Generated Outputs, credentials and business information. Provider Confidential Information includes nonpublic Platform architecture, code, system prompts, model configurations, templates, security controls, test results, roadmap, Custom Developments and pricing. Agreement terms are confidential to both.

9.2Confidential Information excludes information the receiving party proves is or becomes public without breach, was lawfully known beforehand, was lawfully received from an authorized third party, or was independently developed without use of the disclosing party’s Confidential Information.

9.3The receiving party shall use Confidential Information only to perform or exercise Agreement rights, protect it with at least reasonable care, and disclose it on a need-to-know basis to personnel, Affiliates and professional advisers bound by equivalent confidentiality duties. Provider may disclose Customer Confidential Information to contractors and Subprocessors, including hosting and AI suppliers, only as necessary to provide Services and underwritten confidentiality obligations. DPA-authorized disclosures are not breaches. The receiving party remains responsible for recipients.

9.4The receiving party may disclose information where legally compelled, giving advance notice where permitted and disclosing only what is necessary; it shall promptly notify the disclosing party of known unauthorized disclosure or use.

9.5Upon termination or request, the receiving party returns or deletes Confidential Information, except legally required copies and routine backups pending overwrite, which remain protected. Customer Data is governed by Section 5.5 and the DPA.

9.6These obligations apply during the Agreement and five (5) years thereafter, indefinitely for trade secrets while legally protected and for Customer Data held by Provider or Subprocessors. No license for Confidential Information is granted; injunctive relief may be sought in addition to other remedies.

10. Support and Maintenance

10.1Provider supplies approximately one hour of onboarding, initial training, practical help with the first Application and periodic follow-up meetings (approximately every two weeks) during the initial phase, as specified in the onboarding plan. Standard support is via email/ticket during business hours. Enterprise includes a dedicated Customer Success Manager and solutions architect, with service levels in a separate Service Level Agreement (SLA).

10.2Provider uses reasonable efforts to maintain Platform availability, does not guarantee uninterrupted service, and gives planned-maintenance notice where practicable. Confirmed defects reported to support are investigated and corrected using reasonable efforts within a reasonable period based on severity, unless an Enterprise SLA states otherwise.

11. Warranties, Liability and Indemnification

11.1Each party represents that it has authority to enter the Agreement. Provider performs with reasonable skill and care in accordance with Documentation. Provider’s obligations are obligations of reasonable efforts, not guaranteed results.

11.2TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE PLATFORM IS PROVIDED “AS IS.” EXCEPT AS EXPRESSLY PROVIDED IN SECTION 11.1, PROVIDER DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. PROVIDER DOES NOT WARRANT ERROR-FREE OR UNINTERRUPTED SERVICE, ACCURACY OR COMPLETENESS OF GENERATED OUTPUTS, CONTINUED THIRD-PARTY MODEL AVAILABILITY, ABSENCE OF OPEN-SOURCE VULNERABILITIES OR FITNESS OF AN APPLICATION FOR CUSTOMER’S PURPOSE. CUSTOMER SHALL TEST AND VALIDATE BUSINESS-CRITICAL OR REGULATED USES.

11.3Nothing excludes or limits liability for fraud, intentional misconduct, gross negligence where non-excludable, personal injury or death where legally non-excludable, or any liability that applicable law prohibits limiting.

11.4Subject to Section 11.3, neither party is liable for lost profits, revenue, data, contracts, customers or goodwill, reputational injury or indirect or consequential loss, nor is Provider liable for consequences of decisions based on unverified Generated Outputs contrary to Section 8.4, to the maximum extent permitted by law.

11.5Subject to Section 11.3, Provider’s aggregate liability arising from or related to the Agreement, including the DPA to the extent permitted by applicable privacy law, for all claims in any twelve (12)-month period is limited to fees paid by Customer to Provider in the twelve (12) months before the event giving rise to the claim. This limit does not apply to Customer payment obligations. Claims must be brought within one (1) year of accrual to the extent enforceable under applicable law.

11.6Customer shall defend, indemnify and hold Provider harmless from third-party claims, legally indemnifiable fines, damages and reasonable costs arising from (a) Customer Data or Applications infringing third-party rights or unlawfully processed; (b) Customer breach of Sections 2.4, 6.5, 6.6 or 7, Applicable Data Protection Laws or applicable AI law; or (c) unlawful Customer instructions, except to the extent caused by Provider’s or its Subprocessors’ breach of this Agreement, DPA or applicable data laws. Provider shall promptly notify Customer, allow Customer to control defense without admitting liability on Provider’s behalf, and reasonably cooperate at Customer’s expense.

11.7The parties acknowledge that fees reflect this allocation of risk.

12. Compliance and Publicity

12.1Each party complies with laws applicable to it, including privacy, anti-bribery, export control and sanctions laws. Customer shall not use or make the Platform available in breach of applicable sanctions or export restrictions.

12.2Customer shall not use Provider, YouCraft or Third-Party AI Model supplier names, logos or marks publicly or in marketing without prior written consent. Provider may identify Customer by name and logo as a customer reference unless Customer objects in writing.

13. General Provisions

13.1Assignment. Customer may not assign without Provider consent. Provider may assign to an Affiliate or in a merger or sale of its business upon notice.

13.2Force majeure. Neither party is liable for delay or failure caused by events beyond reasonable control, including widespread outages, cyberattacks, network failures, critical supplier unavailability, Third-Party AI Model restrictions or changes in law.

13.3Entire agreement; severability; waiver. The Agreement supersedes prior discussions; invalid provisions do not affect the remainder; failure to enforce is not waiver.

13.4Amendments. Amendments require both parties’ written agreement except price/plan changes under 4.4, DPA/Subprocessor updates, and technical, security, regulatory or AI-supplier-required access terms that do not materially reduce Customer’s essential rights, with at least thirty (30) days’ notice. Customer may terminate upon notice within that period if materially adversely affected. Changes to fixed-version linked documents must be archived and notified; posting alone is insufficient for material amendments.

13.5Notices. Notices are sent to the contacts identified in the Order Form. Termination notices must be given in writing by a method that provides evidence of receipt, including email with written acknowledgement, or tracked mail (Sections 5.2 and 5.7).

13.6Electronic signatures. The Order Form may be signed electronically, including through a recognized electronic-signature platform, under the applicable Canadian federal and provincial electronic commerce and electronic signature legislation (including applicable provincial legislation); the parties agree that such signature has the same legal effect as a handwritten signature.

13.7Governing law and jurisdiction. This Agreement is governed by the laws of the Province of Québec and the federal laws of Canada applicable therein, without regard to conflicts-of-law principles. Subject to mandatory applicable law, the courts located in Montréal, Québec have exclusive jurisdiction.

13.8Survival. Sections 5.5, 8, 9, 11, 12 and 13 and provisions intended to survive continue after termination.

Acceptance. These General Terms do not have a separate signature block. They are incorporated into each Order Form referencing them and accepted by execution of that Order Form.