Terms Of Service
License Agreement
between reqms AI GmbH, Pilgrimstraße 6, 50674 Köln (‘Licensor’) and the customer (‘Licensee’) for the provision of a developer integrator solution for AI Applications by way of software rental (Software as a Service), which necessitates both access via a web-based interface and integration through an API.
Licensor has developed the App and shall rent to the Licensee. The parties conclude the following contract for this purpose. The Licensor’s offer is directed exclusively at entrepreneurs within the meaning of Section 13 of the German Civil Code (BGB).
1. Scope
- The scope of this License Agreement (‘Agreement’) is:
- the time-limited use of the computer program ‘Assistant Engine’ (‘App’) described in the offer to Licensee for a fee in conjunction with the granting of rights of use thereto.
- The Licensee uses the App by transferring data to be processed online to the Licensors host computer system via Licensees servers or personal systems, carrying out the desired processing with the App provided and receiving the results back online. The App has different modules and usage limits, depending on which version the Licensee has licensed. The basic version includes the following services:
- Hosting of the App in a data centre (‘cloud’):
- Provision of the browser-based Admin Panel for Licensee to configure and monitor developer integrator solution;
- Provision of third-party API Access to Licensee for transfer of request and response data.
- The Licensee’s use of the App is subject to limitations depending on which version the Licensee has licensed. The specific limitations applicable to the Licensee’s version are outlined in the offer to Licensee. These limitations include, but are not limited to:
- The maximum number of projects that can be created within the App;
- The maximum number of tasks and assistants that can be defined.
- The maximum number of tools that can be configured.
- The maximum number of Calls that can be performed.
- Licensor shall continuously develop the App and optimize it in accordance with the needs of its customers. As all customers use the same version of the App, the Licensee is not entitled to use a specific version.
- The Licensee is not authorized to host the App on its own systems.
2. Function of the App
- Licensee has the ability to create a “Tool” within the App: A Tool within the context of this Agreement refers to any external service or API that the Licensee integrates into the App for interaction with the AI-based system chosen by Licensee. By creating a Tool, the Licensee establishes a connection to an external service through a defined API schema and endpoint URL, thereby enabling the App to communicate with this external service on behalf of the Licensee.
- Licensee confirms that it has the necessary rights and permissions to upload and use any APIs, data, or services it connects to the App. Licensee acknowledges that by providing API access, an AI-based system chosen by Licensee may perform CRUD (Create, Read, Update, Delete) operations on Licensee’s behalf, which includes creating, retrieving, modifying, and deleting data within the scope of the API access provided. Licensee understands that the AI may unintentionally generate requests beyond the initial API schema due to AI-based interpretations or inaccuracies. The Licensor does not have any impact of such behaviors as he only provides the API/connection for an AI-based system to communicate with a Tool.
- The Licensee acknowledges that data, including personal data, may be transferred to external tools or services integrated by Licensee within the App. Licensee is responsible for ensuring that such tools or services have the appropriate permissions to process or store the data in compliance with applicable data protection regulations. It is the Licensee’s duty to restrict access to only authorized personnel and to enforce proper access control measures for any sensitive data accessed or processed through the App.
3. Delivery of the App
- Licensor provides the App as a browser-based application in combination with access to an API. The Licensee receives access to the App via an individually created user name and a suitable password. The Licensee receives access to the API via an automatically assigned API token upon Licensee’s request of such in the App Admin Panel.
- Licensor offers optional, complementary user interface components, which are made available under the MIT License via GitHub.
- Licensee shall be solely responsible for its technical infrastructure (hardware, browser, software for API access) and internet access.
4. Maintenance
- Licensor is obliged to maintain the contractually agreed quality of the App during the term of the contract (‘maintenance’). The contractually owed quality of the App is determined by the offer. In order to fulfil its maintenance obligation, Licensor shall carry out the necessary maintenance and servicing measures.
- Licensor shall only be obliged to modify, adapt and further develop the App if the parties agree this separately. In particular, Licensor shall not be obliged to further develop the App without such a separate agreement.
5. Grant of Rights
- Upon full payment of the remuneration in accordance with section 5 of this Agreement, Licensor grants Licensee a worldwide non-exclusive right, limited to the term of this Agreement, to access the App with an agreed number of users for the contractual purpose (‘User Licences’). If individual modules of the App are licensed irrespective of the number of User Licences, Licensor grants Licensee a worldwide non-exclusive right, limited to the term of this Agreement, to use the corresponding modules of the App for the contractual purpose, whereby Licensee may access the modules with a defined number of users (‘Module Licences’). The contractual use of the App includes displaying and running the App provided.
- Licensee is not entitled to reproduce the App and may not sell, give away, lend, lease, rent or sublet the App to third parties.
- The circle of users is limited to employees of the Licensee and third parties authorised by Licensee. These third parties require a User Licence for access in accordance with section 4.1.
- The Licensee is not authorised to modify, edit or otherwise alter the App.
- Any use of the App after termination of the contractual relationship is not permitted.
- For clarification: If the App contains connections to open source components, the use of the respective open source component is based on the respective open source licence (MIT licence).
6. Remuneration
- Licensee is obliged to pay a monthly fee for the provision of the App in the amount specified in the offer plus the applicable VAT at the start of the contract. If the App is provided for a shorter period than a full calendar month, the remuneration shall be reduced pro rata temporis.
- The remuneration owed by Licensee shall be paid in advance by direct debit via the payment service provider Stripe.
- The ‘Free’ version is free of charge.
7. Duty of Care
- Licensee is obliged to take appropriate measures to ensure that unauthorised third parties cannot access the App or other accompanying materials.
- Access to LLM providers and other service providers is established via the respective API key of Licensee, which Licensee must enter in the App. Licensor does not provide API keys for the LLM providers and other service providers. Licensee must ensure that only authorized employees have access to the respective service (access control).
- Access to other tools and service providers integrated within the App is established via the Licensee’s connections to own services and/or licensee’s third party service. The Licensor does not provide access credentials, accounts, or keys for any third-party tools or services.
- The Licensee must implement appropriate access control measures to ensure that only authorized employees can access and operate these integrated tools and services. It is the Licensee’s responsibility to regularly review and manage access rights to maintain security and prevent unauthorized use or disclosure of API keys, data, or other sensitive information integrated within the App.
8. Force Majeure
- Events or circumstances of force majeure that prevent the provision of a service shall release the party affected from its obligations for the duration and scope of the hindrance. ‘Force majeure’ means the occurrence of an event or circumstance which prevents a party from fulfilling one or more of its contractual obligations under the contract if and to the extent that the party affected by the impediment proves that such impediment is beyond its reasonable control; and it could not reasonably have been foreseen at the time of the conclusion of the contract; and the effects of the impediment could not reasonably have been avoided or overcome by the affected party. This includes war (declared or undeclared), hostilities, aggression, acts of foreign enemies, large-scale military mobilisation; civil war, riot, rebellion and revolution, military or other seizure of power, insurrection, acts of terrorism, sabotage or piracy; currency and trade restrictions, embargo, sanctions; lawful or unlawful official acts, compliance with laws or government orders, expropriation, confiscation of works, requisition, nationalisation; plague, epidemic, natural disaster or extreme natural event; explosion, fire, destruction of equipment, prolonged breakdown of means of transport, telecommunications, information systems or energy; general industrial unrest such as boycott, strike and lockout, go-slow, occupation of factories and buildings.
- The party affected by a force majeure event is obliged to use its best endeavours to minimise the effects of the force majeure as far as is commercially reasonable.
- Events and circumstances that were foreseeable when the Agreement was concluded, insolvencies or delays in deliveries and services by upstream suppliers or vicarious agents of the Licensor and a lack of financial resources on the part of the Licensee shall not be considered force majeure.
- The contracting parties shall inform each other immediately of any circumstances of force majeure.
9. Warranty
Licensor warrants that the services to be provided by it are free from third-party rights. In the event of an infringement of third-party property rights, Licensor shall – at Licensee’s discretion – provide Licensee with the right to use the App or design the App free of rights of third party. The Licensor will make commercially reasonable efforts to ensure the App is available; at least for 97% per month.
- Scheduled maintenance will be performed during non-peak hours whenever possible but is not guaranteed to avoid service disruption.
- Should Licensee discover defects in the App or documentation, it must notify Licensor of these immediately in writing.
- In the event of material defects, Licensor shall be entitled to decide at its own discretion whether a defect is to be remedied or whether an alternative solution (workaround) is to be provided. Otherwise, the statutory provisions shall apply.
- Licensee shall not be entitled to claim a reduction in rent/remuneration by deducting the amount of the reduction from the current remuneration. This shall not affect any right of Licensee under the law of unjust enrichment to reclaim the part of the remuneration paid in excess due to a justified reduction.
- The Licensor makes no warranties or guarantees concerning the availability, performance, or reliability of any third-party APIs, including but not limited to the OpenAI API or any other external tools or services integrated by the Licensee as part of the App’s functionality. Any disruptions, delays, or failures caused by third-party APIs shall not constitute a breach of this Agreement, and the Licensor shall not be held liable for any damages or losses resulting from such issues.
- The App is optimized for the browser ‘Google Chrome’ and for security reasons for the current version. Use with other browsers or outdated versions of ‘Google Chrome’ may result in a different user experience but does not constitute a defect.
10. Liability
- If there is no special provision in this Agreement (e.g. for warranty), Licensor shall be liable in accordance with the statutory provisions for damages (a) caused intentionally or through gross negligence by Licensor, one of its legal representatives, executive employees or vicarious agents; (b) arising from culpable injury to life, limb or health; (c) in accordance with the Product Liability Act or other mandatory provisions. Licensor shall be liable for damages caused by breach of material contractual obligations (obligations whose fulfilment is essential for the proper performance of the contract and on whose fulfilment the Licensee may regularly rely) by Licensor, one of its legal representatives, executives or vicarious agents with only simple negligence to legal interests other than life, body or health, only to the amount of the foreseeable damage typical for the contract. Otherwise, the liability of the Licensor, one of its legal representatives, executive employees or vicarious agents is excluded.
- In the case of use of the ‘Free’ version, liability is limited to intent and gross negligence.
11. Term and Termination
- This Agreement comes into force upon acceptance of the offer (‘Place Order” button). The Service is billed on a subscription basis (“Subscription(s)”). The Licensee will be billed in advance on a recurring and periodic basis (“Billing Cycle”). Billing cycles are set on a monthly basis, unless otherwise agreed. At the end of each Billing Cycle, the Subscription will automatically renew under the exact same conditions unless the Licensee terminates it or the Licensor terminates it. Each party may terminate the Agreement with one week’s notice to the end of the respective month.
- The Licensee acknowledges that the Licensor may prospectively change the specified rates and charges for the services from time to time. Such changes will be communicated to the Licensee in advance, with a reasonable notice period. If the Licensee does not agree to the changes, each party has the right to terminate the agreement as set forth in 10.1.
- The right of both parties to cancellation without notice at any time for good cause remains unaffected. Good cause shall be deemed to exist in particular if one of the parties wilfully or negligently breaches a material obligation under this Agreement and it is therefore no longer reasonable to expect the terminating party to adhere to the agreement. In particular, Licensor shall be entitled to terminate the Agreement extraordinarily and without notice if Licensee violates the provisions of section 4 of this Agreement and does not cease its acts of violation within a reasonable period of time, if Licensor has previously requested Licensee to cease such acts of violation.
- Cancellation of this Agreement must be done through the “Cancel Subscription” button in the Manage Subscription section or by deleting the account in the Edit Profile section of the App’s Admin Panel.
12. Data Protection
- The parties shall comply with the data protection regulations.
- The parties shall conclude a data processing agreement pursuant to Art. 28 para. 3 GDPR, which is part of this contract as Annex 1.
13. Miscellaneous
- Amendments and supplements to this Agreement, including this Section 12.1, must be made in writing, unless otherwise specified.
- The parties may only transfer this contract and the rights and obligations arising from this Agreement to a third party with the prior written consent of the other party.
- There are no verbal or written collateral agreements to this contract. The liability of the General Terms and Conditions of the Licensee is expressly excluded.
- The place of contract fulfilment is Licensor’s registered office.
- The exclusive place of jurisdiction for all disputes arising from or in connection with this Agreement shall be the registered office of Licensor, unless an exclusive place of jurisdiction is provided by law. Licensor shall remain entitled to bring an action at the general place of jurisdiction of Licensee.
- This contract is subject to the law of the Federal Republic of Germany with the exception of the conflict of laws; the provisions of the UN Convention on Contracts for the International Sale of Goods are excluded
Annex 1: Data Processing Agreement
within the Meaning of Art. 28, 29 of the GDPR
entered into by and between
reqms AI GmbH
Pilgrimstraße 6
50674 Köln
– hereinafter “Licensor” –
and
the customer
– hereinafter “Licensee” –
Recitals
Processor processes personal data under the authority of Controller within the meaning of Art. 4 no. 8 and Art. 28 of Regulation (EU) 2016/679 – General Data Protection Regulation (hereinafter “GDPR“). This Data Processing Agreement (“Agreement”) defines the specific data protection obligations of the parties arising in connection with the outsourced data processing provided for in the master agreement („License Agreement“). This Agreement applies to all services which relate to the master agreement and in connection with which employees of the Processor or third parties acting on behalf of the Processor may come into contact with personal data provided by the Controller. This contract is part of the License Agreement as Annex 1 and comes into effect upon the conclusion of the License Agreement.
Section 1
Definitions
1.1 Personal data means any information provided by the Controller relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Art. 4 no. 1 of the GDPR).
1.2 Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4 no. 2 of the GDPR).
1.3 Instructions are any directions issued by the Controller to the Processor ordering the Processor to process personal data. Instructions are originally defined by the master agreement and thereafter may be modified, amended, or replaced by Controller through written, individual instructions (“Individual Instructions”).
Section 2
Applicability, Responsibility
The Processor shall process personal data under the authority of the Controller. The Controller is the sole party responsible for the compliance with all applicable data protection laws, especially the lawful transfer of personal data to contractors and the processing of personal data (“controller” within the meaning of Art. 4 no. 7 of the GDPR).
Section 3
Duration
The term of this Agreement corresponds to the term of the master agreement. The right to terminate for good cause shall remain unaffected thereby.
Section 4
Extent, Type, and Purpose of the Processing of Personal Data
The extent, type, and purpose of the processing of personal data by the Processor under the authority of the Controller are described in detail in the master agreement and the service description.
Section 5
Type of Data
The processing of personal data involves the following types/categories of data (enumeration/description of data categories):
- Connection data (IP address, date/time)
- Name, first name
- Voice, image, and text files, particularly chat logs that are generated during/by the use of the app.
- Content of the software application that is transmitted as context when using the user interface components.
- All data that the Licensee provides to the Licensor for transmission to the LLM.
- All data that the LLM or conntected tools / third-party APIs returns as feedback to the App.
Section 6
Data Subjects
The group of Data Subjects whose personal data is processed includes:
- Users of the app (Licensee)
- Persons and end users whose data is transmitted by the Licensee via the admin panel and/or the API interface.
- Persons whose data becomes subject to data processing by the use of tools / third-party APIs connected to the app by the Licensee.
Section 7
Rectification, Erasure, Blocking, and Return of Data
7.1 The Controller may demand that personal data be rectified, erased, blocked, or returned at any time during or after the term of this Agreement and the master agreement by means of a legitimate Individual Instruction.
7.2 The Controller shall determine the measures for the surrender of the data carriers provided and/or deletion of the stored personal data after termination of the Agreement by contract or by Individual Instruction.
Section 8
Technical and Organizational Measures
8.1 The Processor shall implement technical and organizational measures to adequately protect personal data against the risks of misuse and loss in conformity with the requirements of Art. 24, 32 of the GDPR. Such measures include, without limitation, the following, provided that such measures are appropriate:
- measures preventing unauthorized parties from gaining access to data processing systems employed to process or use personal data (physical access control);
- measures preventing unauthorized parties from using data processing systems (system access control);
- measures guaranteeing that persons authorized to use data processing systems have access exclusively to personal data covered by their access authorizations, and that personal data cannot be read, copied, modified, or removed without authorization during and after the processing (data access control);
- measures guaranteeing that personal data cannot be read, copied, modified, or removed during electronic transfer or during transport or storage on data carriers and that it is possible to review and determine to whom personal data are to be transferred using data transmission systems (data transfer control);
- measures guaranteeing that it can be reviewed and determined later on whether and by whom personal data have been input into, modified in, or removed from data processing systems (data input control);
- measures guaranteeing that personal data processed by the Processor can be processed only as instructed by the Controller (order control);
- measures guaranteeing that personal data are protected from accidental erasure or loss (data availability control);
- measures guaranteeing that personal data that have been collected for different purposes can be processed separately (data separation control);
- measures for the pseudonymization and encryption of personal data;
- measures guaranteeing on a long-term basis the capability, confidentiality, integrity, availability, and resilience of systems and services related to the processing of personal data;
- measures guaranteeing that in the event of any physical or technical incident the availability of personal data and access to personal data can be quickly restored; and
- procedures for the regular review, analysis, and evaluation of the effectiveness of technical and organizational measures to guarantee the security of the processing of personal data.
8.2 Technical and organizational measures are subject to technological progress and continued development. Therefore, the Processor is permitted to implement adequate alternative measures, provided that such alternative measures guarantee the same level of security as the agreed measures. Any material changes that may adversely affect the integrity, confidentiality, or availability of personal data are to be documented.
Section 9
Instructions
9.1 The Controller shall have the right to issue Individual Instructions regarding the type, extent, and procedures of the processing of personal data to the Processor. Such instructions are to be issued in written form.
9.2 The Processor shall process personal data only within the framework of the master agreement, the Agreement and Individual Instructions, unless the Processor has a legal obligation to process personal data under EU law or the law of any member state.
9.3 Provisions regarding any compensation for additional costs incurred by the Processor as a result of Individual Instructions issued by the Controller shall remain unaffected thereby.
9.4 The Processor shall notify the Controller of any exceptions to the obligation to process personal data only in accordance with the Controller’s instructions that may apply to the Processor under applicable law, unless such notification is prohibited by such applicable law for the protection of an important public interest.
Section 10
Other Obligations of the Processor
10.1 The Processor designates – if obliged by law – a data protection officer who can carry out his duties in accordance with Art. 37, 38, 39 of the GDPR. The Processor shall provide the Controller with the name and contact information of its data protection officer (if applicable) on request.
10.2 The Processor shall require those of its employees who are assigned to process personal data to agree to comply with the duty of data confidentiality (Art. 29 of the GDPR) and provide such employees with training and instruction on compliance with the data protection provisions of the GDPR. The duty of data confidentiality continues in effect after work has been completed.
10.3 The Processor shall notify the Controller of any major disruptions of Processor’s business operations, of any suspected data breaches, and of any other irregularities concerning the processing of personal data. This also applies to any audits, measures by the regulatory authority within the meaning of Art. 51-59 of the GDPR, or investigations within the meaning of Art. 83, 84 of the GDPR.
10.4 The Processor acknowledges that he may be subject to disclosure obligations under Art. 33 of the GDPR in the event of any unlawful transfer or acquisition of certain personal data. Therefore, such incidents must be reported immediately to the Controller regardless of the cause. The Processor’s report to the Controller shall include, without limitation, the following information:
- A description of the type of breach regarding the protection of personal data, including – if possible – the categories and approximate number of affected Data Subjects, and the categories and approximate number of affected personal data sets;
- A description of the measures implemented or proposed by the Processor to remedy the personal data breach and, if applicable, measures to mitigate potential adverse effects of the breach.
The Processor shall implement adequate measures to secure personal data and to mitigate potential adverse consequences for Data Subjects in agreement with the Controller.
10.5 The Processor has an obligation to notify the Controller at any time if data or documents of the Controller are affected by a personal data breach. The destruction of data material in compliance with data protection regulations shall be carried out by the Processor at his own expense, based on an Individual Instruction by the Controller. In special cases designated by the Controller in writing, data shall be stored or returned to the Controller.
Section 11
Rights and Obligations of the Controller
11.1 The Controller is the sole party responsible for assessing the lawfulness of the processing of personal data as well as for protecting the rights of the Data Subjects.
11.2 The Controller shall promptly and fully inform the Processor in writing if the Controller discovers any errors or irregularities with respect to data protection laws during its review of data processing results.
11.3 The Controller is responsible for keeping a record of processing activities as required by Art. 30 of the GDPR.
11.4 The Controller is responsible for complying with the notification obligations under Art. 33 of the GDPR.
Section 12
Inquiries from Data Subjects
12.1 If the Controller is obligated under applicable data protection law to provide individuals with information about the processing of their personal data, the Processor shall – when necessary – assist the Controller with making such information available, provided that the Controller has requested such assistance from the Processor in writing.
12.2 The Processor shall inform the Controller if Data Subjects assert their data protection rights against the Processor.
Section 13
Cooperation with Regulatory Authority
Upon request the Controller and the Processor and, if necessary, their respective representatives shall cooperate with the regulatory authority when performing their responsibilities.
Section 14
Inspection Obligations of Controller
The Controller approves the technical and organizational measures taken by the Processor before transmitting data to the processor and continually during the term of this agreement and documents the result. For this purpose, he may request self-disclosure from the Processor or may conduct an audit during regular business hours with at least one month prior notice at its own cost. In case of an audit, the Controller bears the costs of manpower to be provided by the Controller in order to conduct the audit.
Section 15
Subcontractors
15.1 Commissioning of sub-processors under this agreement and mentioned tasks in Sections 3, 4, 5, possible as long as the Processor ensures that the sub-processor is subject to the same obligations laid out in this Agreement, in particular, the Processor shall verify that the requirements of confidentiality, data protection and data security stipulated in this Agreement are met.
15.2 The Controller shall receive inspection rights in the sense of Section 14. By written request of the Controller, the Processor shall provide the Controller with information about the relevant contents of the data processing agreement between the Processor and the sub-processor as well as a copy thereof.
15.3 The sub-processors engaged by the Contractor are listed in Annex 2.1 “Subcontractors”. The Processor shall be entitled to engage further sub-processors, provided that they comply with the requirements pursuant to section 15.1 and 15.2 and the Processor informs the Controller thereof and the Controller does not object in writing within seven days.
Section 16
Duty of Confidentiality
The Processor is obliged to maintain confidentiality when processing personal data. The Processor agrees to comply with the same data confidentiality obligations to which the Controller is subject. The Controller shall notify the Processor in writing of any special data confidentiality obligations.
Section 17
General Provisions, Disclosure Obligations, Written Form, Choice of Law
17.1 If personal data should be jeopardized at the Processor’s place of business as a result of any attachment or seizure proceeding, any insolvency or composition proceeding, or any other events or third-party measures, the Processor shall promptly notify the Controller thereof. The Processor shall immediately notify all relevant parties regarding this event that the Controller has the exclusive ownership of and authority over the personal data and is therefore the “controller” within the meaning of the GDPR.
17.2 Personal data shall be processed and used exclusively in the territory of the Federal Republic of Germany, in any member state of the European Union, or in any other country that is a party to the Agreement on the European Economic Area. Each transfer of personal data to a third country is subject to the prior consent of the Controller and may proceed only if the special requirements of Art. 44, 45, and 46 of the GDPR are satisfied. Insofar as the processing is carried out by a Subcontractor named in Annex 2.1 “Subcontractors”, the Controller hereby gives its consent.
17.3 Any modifications or amendments to this Agreement or its provisions – including any representations by the Processor – shall require a written agreement and shall be expressly identified as modifications or amendments to provisions of this Agreement. The same shall also apply to any waiver of this form requirement.
17.4 This Agreement shall be subject to German law with the exception of the conflict of laws provisions.
17.5 Venue and jurisdiction shall be as provided in the master agreement, provided that under the terms of the master agreement venue and jurisdiction is in courts of the Federal Republic of Germany. Otherwise, exclusive venue and jurisdiction shall be in courts at the place of Processor registered office.
Annex 2.1: Subcontractors
- Hetzner Online GmbH: Cloud-Hosting.
Industriestr. 25, 91710 Gunzenhausen (Germany)