Terms and conditions

1. About these terms

These terms are the agreement between Equites Digital BV, which provides kvyk.ai (“kvyk.ai”, “we”, “us”), and the organisation that uses kvyk.ai (the “customer”). The data processing agreement in the annex is part of them.

The customer accepts these terms when a person creates an organisation on kvyk.ai. That person confirms that they may act for the customer and accept these terms on its behalf.

kvyk.ai is for businesses and other organisations, for their professional activity. It is not offered to consumers.

These terms are written in English, Dutch and French. If the versions differ, the English version applies.

2. Words used in these terms

• Service: kvyk.ai, the platform on which the customer describes, builds, runs and changes AI-driven business apps, with its dashboard, its assistant, its apps and the documentation.
• Organisation: the customer’s own space on kvyk.ai, with its data, its people and its apps.
• Users: the people the customer lets use the service: the people it invites into its organisation, and its own customers who sign in to its apps.
• Customer data: the data the customer and its users put into the service, such as records, files, and what they write to the assistant.
• Apps: the applications kvyk.ai builds and runs for the customer in its organisation.

3. The service

We provide the service as it is described in the documentation at kvyk.ai/docs. kvyk.ai is in early access: we keep improving it, and features may be added, changed or removed. When a change takes away something the customer relies on, we tell the customer’s Administrators in advance where we can.

4. Users and accounts

The customer decides who can use its organisation and with which role, and keeps that up to date. The customer is responsible for what its users do in the service and makes sure they follow these terms.

Every person who uses kvyk.ai accepts the acceptable use rules in the dashboard before using it, and again when the rules change. Users sign in with their email address; they do not give anyone else access to their mailbox.

5. Acceptable use

The customer and its users do not use the service:

• for anything illegal, or to store or share content that is illegal or infringes the rights of others;
• to spread malware, or to send spam or other unsolicited messages;
• to try to break, overload or get around the security of the service, or to reach data of other organisations;
• to resell the service, or offer it to others as a service of their own, without our written agreement.

If the customer or a user breaks these rules, we may suspend the organisation or the user. We tell the customer first and give it a chance to put things right, unless the breach is serious or we must act at once to protect the service, other customers or the people concerned. We lift a suspension once the cause is gone.

6. Plans, prices and payment

kvyk.ai has two plans, Free and Pro. What each plan holds and costs is on the pricing page, and the organisation’s settings show what each plan allows. The Free plan costs nothing, for as long as the customer uses it. The Pro plan costs EUR 19 per organisation per month, excluding VAT, paid monthly in advance. There is no free month of Pro.

Only businesses can pay, with their VAT number. A business in Belgium is charged Belgian VAT; for a business elsewhere in the European Union whose VAT number the EU’s VAT check confirms, the VAT is reverse charged. Payments go through Mollie B.V., the Netherlands, our payment provider.

An Administrator moves the organisation to Pro by paying its first month. The organisation is on Pro once the payment is through, and each next month is charged on the same day of the month. The invoice of each paid month can be downloaded in the organisation’s settings.

An Administrator can cancel at any time. No further payment is taken, and Pro runs to the end of the month paid. Months paid are not refunded.

When a payment fails or is reversed, we tell the Administrators, and the organisation stays on Pro for 14 days to pay. If it is not paid by then, the organisation moves to Free. Moving to Free takes nothing away: what the organisation has stays, it only cannot add more than Free allows.

We announce a change of price at least 30 days before it applies, and the customer can cancel before then. The prices on the pricing page are launch prices: a customer who signs up while they apply keeps them for 6 months after a change, and the change applies to it only after those 6 months.

7. Availability and support

We do our best to keep the service available and working, but during early access we do not guarantee a level of availability. We aim for the service to be up 99.5% of each calendar month, as a target and not a promise.

The status page at status.kvyk.ai checks the dashboard, the apps, the assistant, and sign-in and mail every minute, from outside the platform, and shows the uptime of the last 90 days. We post every incident, its updates and every planned maintenance there, where anyone can subscribe to them by email, and the dashboard shows a notice while one is under way. We announce planned maintenance in advance where we can. Support is by email.

8. Customer data

The customer owns its customer data. We use customer data only to provide the service to the customer, as set out in the data processing agreement in the annex. We do not sell it, and we do not use it, or let our subprocessors use it, to train AI models.

The customer can export its data from the service at any time while the contract runs, and for 30 days after it ends.

The service offers a privacy statement that the customer can use for its apps, published and hosted by us in the customer’s name and filled in with the details the customer gives. It is a template, offered as is: it is not legal advice. The customer, as controller, checks that it fits what it does before choosing it and while it uses it, and remains responsible for what it tells the people whose data it keeps.

9. Intellectual property

Everything in the service other than customer data stays the property of kvyk.ai: the platform, its software, the apps, including their code and the building blocks they are made of, the templates, the design and the documentation.

While the contract runs, the customer may use the service and the apps built for it for its own business. This right cannot be transferred, and ends when the contract ends.

If the customer sends us ideas or feedback, we may use them freely.

10. Confidentiality

Each party keeps confidential what it learns about the other’s business through the service and that is not public, and uses it only for this agreement. This continues after the contract ends.

11. Liability

Our total liability under these terms is limited to the amounts the customer paid us for the service in the 12 months before the event that caused the damage.

We are not liable for indirect damage, such as lost profit, lost revenue, lost customers or lost savings.

These limits do not apply to damage we cause on purpose or through gross negligence, nor where the law does not allow liability to be limited.

The customer is responsible for the customer data it and its users put into the service, and for the use they make of it.

12. Duration and ending

The contract starts when the organisation is created and runs until it is ended.

• The customer can end it at any time: an Administrator ends it in the organisation’s Settings, or the customer tells us by email.
• We can end it by telling the customer at least 30 days in advance.
• Either party can end it at once if the other seriously breaks these terms and does not put it right within 14 days of being asked to.

After the contract ends, the customer can still export its data for 30 days. Then we delete the organisation and its data. Copies in our backups are deleted as those backups expire.

13. Changes to these terms

We may change these terms. We tell the customer’s Administrators by email at least 30 days before a new version takes effect. The date at the top of this page is the day the version in force took effect.

From that day, an Administrator accepts the new version for the customer in the dashboard. Until one does, the dashboard asks for it and says when the 30 days below end, and the organisation’s apps keep working.

For 30 days after a new version takes effect, the previous version keeps applying to a customer that has not accepted the new one. We remind its Administrators by email 7 and 23 days after the new version takes effect, unless the organisation is ending or suspended. If the customer does not agree, it can end the contract within those 30 days; the previous version then applies until the contract ends and to what follows under section 12. If the customer neither accepts the new version nor ends the contract within those 30 days, its continued use of the service after them counts as accepting it.

14. Law and courts

Belgian law governs these terms. Any dispute is brought before the courts of Leuven, Belgium.

15. Contact

Equites Digital BV, Sint-Niklaasstraat 24, 3321 Outgaarden, Belgium, enterprise number 1014.475.389, register of legal entities (RPR) Leuven, VAT BE 1014.475.389. Email: privacy@kvyk.eu.

Annex: data processing agreement

This annex applies when we process personal data on the customer’s behalf. It is the agreement article 28 of the General Data Protection Regulation (GDPR) requires.

A1. Roles

For the personal data in customer data, the customer is the controller: it decides what goes in and what it is used for. We are its processor: we store and process that data only to provide the service. For our own users’ accounts we are the controller ourselves; our privacy statement explains that part.

A2. What we process

• Purpose: providing the service: storing the data, showing it to the users allowed to see it, running the apps, and letting the assistant work with it when the customer allows that.
• People concerned: whoever the customer keeps data about, such as its employees, customers, suppliers and contacts, and its users.
• Kinds of data: whatever the customer puts in, typically names, contact details, working hours and other business records, and files.
• Duration: while the contract runs, plus the 30 days to export afterwards.

kvyk.ai is not built for special categories of personal data, such as health data. The customer stores such data in kvyk.ai only after it has judged that the measures in this annex are enough for it.

A3. Instructions

We process the data only on the customer’s instructions. These terms and the customer’s use of the service, including the settings it chooses, are those instructions. If we think an instruction breaks the law, we tell the customer. If the law requires us to process data otherwise, we tell the customer first, unless the law forbids that.

A4. Confidentiality

The people who work on kvyk.ai for us are bound to confidentiality, and only reach customer data when that is needed to provide the service or to help the customer with it.

A5. Security

We protect customer data with technical and organisational measures that fit the risk, among them:

• every organisation’s data is kept apart from every other organisation’s;
• users reach only what their roles allow, and the assistant only ever acts with the access of the person using it;
• signing in needs no password: it uses a code or link sent by email that works once and expires;
• connections are encrypted;
• changes are recorded in the organisation’s event log;
• uploaded files are scanned for malware;
• the data is hosted in the European Union.

A6. Subprocessors

The customer allows us to use these subprocessors:

Subprocessor	What for	Where
Scaleway SAS, France	Hosting, databases, file storage, email delivery and logs	Data centres in France and the Netherlands
Mistral AI SAS, France	The AI model behind the assistant and the building of apps	European Union and EFTA
Mollie B.V., the Netherlands	Payments in the customer’s apps, only once the customer connects its own Mollie account	European Union

Mistral processes the assistant’s requests in the European Union and EFTA. The one exception is a web search the assistant makes: only the search query, which holds general terms and no personal data, is sent to Mistral’s global service.

When a user lets an app send messages to their phone, each message passes through the push service of that user’s browser (Apple’s, Google’s or Mozilla’s), which the browser chose, not us. The message is encrypted for the user’s device, so the push service cannot read it: it sees only the device’s push address and when a message goes to it.

When the customer connects its own Mollie account, we send Mollie, on the customer’s instruction, what each payment its apps ask for needs: the amount, the currency, the description and the address to return to. The person paying enters their payment details on Mollie’s page, not in the service. Mollie handles the payment under the customer’s own agreement with it; we keep the keys that let us act for that account encrypted, never in the customer’s records, and the customer can disconnect the account at any time.

For the customer’s Pro plan, Mollie is not our subprocessor: it takes that payment as an independent controller, under its own terms and privacy statement. The person who pays enters the payment details on Mollie’s page, not in the service, and Mollie tells us whether and when each payment was made.

We tell the customer at least 30 days before we add or replace a subprocessor. The customer can object for a good reason; if we cannot find a solution together, the customer can end the contract before the change applies. Every subprocessor is bound to the same data protection obligations as we are, and we remain responsible for it.

A7. Transfers outside the European Union

We do not transfer customer data outside the European Economic Area, apart from the search queries described above. Phone messages pass, encrypted, through the push service of the user’s browser, as described above.

A8. Help to the customer

We help the customer, as far as we can, to answer requests from the people concerned (to see, correct or delete their data), most of which the customer can do itself in the service. We also help with security, data protection impact assessments and consultations with a supervisory authority, where these concern our processing.

A9. Personal data breaches

If we become aware of a breach of customer data, we tell the customer without undue delay, with what we know about it and what we are doing about it, so that it can meet its own obligations.

A10. End of processing

When the contract ends, the customer can export its data for 30 days. Then we delete it, unless the law requires us to keep it. Copies in backups are deleted as those backups expire.

A11. Audits

We give the customer the information it needs to show that this annex is respected. The customer may have our compliance audited by an independent auditor bound to confidentiality, once a year at most, unless there has been a breach, with 30 days’ notice and at its own cost.

A12. Liability

The liability rules of these terms also apply to this annex, as far as the GDPR allows.