Terms of Service

1Parties and definitions

1.1Who these Terms are between. These Terms are a contract between AstroWorks FZE LLC and the business that accepts them.

1.2Who we are. AstroWorks FZE LLC is a company registered in the United Arab Emirates. It runs astroware.ai under the name Astroware. Its registered address is 26th Floor, Amber Gem Tower, Ajman. Its licence number is 2626720742888. Email: core@astroware.ai.

1.3How you accept. You accept these Terms by signing in to the console (the sign-in page says that signing in means you agree to them, with a link), by using a Key, by accepting an Order, or by giving a Test-Run Approval, whichever comes first. If you do not accept them, do none of these.

1.4Businesses only. The Services are for businesses only. You confirm that you accept these Terms for a business, not as a consumer. The person who accepts confirms that they have authority to bind that business.

1.5Definitions. In these Terms:

• "Assistant" means the AI assistant or agent that you name for a test run.
• "AstroWorks", "we", "us" and "our" mean AstroWorks FZE LLC.
• "Screening Tool" or "Service 3" means the free Astroware EU AI Act Risk Screening tool on astroware.ai (section 5).
• "Confidential Information" has the meaning in section 11.1.
• "Customer", "you" and "your" mean the business that accepts these Terms.
• "Customer Data" means the data that you, your users or your systems give us through the Services: the messages you send to the HaloGuard EU API, your Assistant's replies in a test run, and your Test Credentials. It does not include Usage Data or the Test Pack.
• "DPA" means the data processing agreement between you and us for the Services, with its annexes, once it is in force between us (section 10.3).
• "EU AI Act" means Regulation (EU) 2024/1689.
• "Free Services" means the free trial (sections 7.1 to 7.3), the free test runs (section 4) and the Screening Tool (section 5).
• "HaloGuard EU API" or "Service 1" means the HaloGuard EU hosted API (section 3).
• "Key" means an API key we issue to you for the HaloGuard EU API.
• "Order" means a document or email that both of us accept and that sets out a Service, its price or other commercial terms for you. A quote you accept is an Order.
• "Privacy Notice" means the privacy notice at astroware.ai/privacy.
• "Scorecard" means the results of a test run that we give you, shown per area, with a reference for each test your Assistant failed and the area of that test.
• "Scoring Provider" means the AI service provider in the European Union that scores replies in a test run. The DPA names it.
• "Services" means Service 1, Service 2 and the Screening Tool.
• "Test Credentials" means the endpoint address and the API key that you give us for a test run.
• "Test Pack" means our private test requests, their paired legitimate requests, their labels, and our scoring instructions and method.
• "test run" or "Service 2" means a free EU AI Act test run (section 4).
• "Test-Run Approval" means your written OK for one test run (section 7.4 and Schedule 1).
• "Usage Data" means the records we keep about each API call and each Key, as section 10.4 describes. Examples: the time of a call, the Key's identifier, token counts and cost. Usage Data never includes the text of a message.

1.6Reading these Terms. "Including" means including without limitation. "In writing" includes email. Headings are for convenience only.

2The Services: general

2.1What we provide. We provide the Services described in sections 3 to 5, on these Terms and any Order.

2.2Availability starts on our confirmation. A Service is available to you only from the date we confirm in writing that it is available to you. A free trial is the exception: it starts when you complete sign-up in the console. We do not promise any date.

2.3Features marked "coming". Features or tiers that we describe as "coming", including the HaloGuard EU platform tier, are not part of the Services. They become part of the Services only through an Order.

2.4Managed deployment. If you need HaloGuard EU to run in your own environment or cloud account, we can quote for a managed deployment. A managed deployment needs a separate written agreement. These Terms apply to it only as far as that agreement says.

2.5No service levels. We make no commitment on uptime, availability, response time, support hours or support response time. You can message us from the console or at core@astroware.ai. We do not promise support hours or a response time.

2.6Changes. We may change the Services under section 17.

3Service 1: the HaloGuard EU hosted API

3.1What it is. HaloGuard EU is a small guard model, built on Google's Gemma. It sits in front of the output of an AI system in workplace and customer-facing use.

3.2What it does. For each call, you send us a conversation. The guard checks the last message in it. It returns "allow" or "block". When it blocks, it names the policy behind the block, and the part of the EU AI Act that policy relates to, from a set of ten policies we describe to you in writing.

3.3Its purpose. It is designed to block output that would take a system into uses the EU AI Act bans or treats as high-risk. Examples are ranking workers or candidates, or inferring their emotions from their face, voice or body.

3.4What an answer means. "Block" means the model judged a policy breach likely enough to reach the threshold we set. "Allow" means it did not. An answer is not a finding that a message, a use or a system is lawful or unlawful. The part of the EU AI Act named with a block is the part the policy relates to. It is not a finding that a message, a use or a system is prohibited, high-risk or otherwise subject to that part, and it is not legal advice. The ten policies are not a list of everything the Act bans or regulates.

3.5A technical control. HaloGuard EU is a technical control. It does not decide whether your AI system is high-risk. Section 13 applies.

3.6Where it runs. We host the HaloGuard EU API on Google Cloud in the EU: today in the Netherlands and Belgium. This describes how it is hosted now. It is not a promise to keep that region.

3.7Hosted only. We provide HaloGuard EU only as a hosted API, or as a managed deployment under section 2.4. We do not provide, license or share its weights.

3.8Limits. Each Key can have a budget, an expiry date and a limit on requests per minute. We tell you in writing the limits for your Key and any limit on the length of a conversation.

3.9Privacy filter. When the last message you send is a user message, the answer also returns the conversation you sent with personal data replaced by placeholders, such as [PERSON_1]; a map from each placeholder back to the original; and the kinds of personal data found. When the last message is your model's reply, nothing is masked. The guard decides on the original text. Putting the originals back, for example into your model's reply, is your step. An owner of your account chooses in the console what the filter masks: all personal data (the default), all but people's names, or all but the kinds the owner picks. The owner can also turn masking off; then the filter does not run and nothing is masked. Unless masking is off, passwords, access keys and card security codes the filter recognises are always masked. The choice applies to every call made with your Keys; a change can take a minute or more to apply. Personal data you choose not to mask is returned as you sent it, and you decide whether to pass it to your model. The filter can miss personal data, and it can mask text that is not personal data. Masked text is not anonymous while you keep the map. If the filter cannot answer, the answer says so and nothing in it is masked. Section 10.3 applies.

4Service 2: free EU AI Act test runs

Free test runs are available only to companies we invite. This section, and the other sections about test runs (6.5, 7.4 to 7.14, 9.3(h), 13.3 and Schedule 1), apply only once we confirm in writing that test runs are available to you (section 2.2).

4.1What it is. At your request, we run our EU AI Act behaviour test against your Assistant, through Test Credentials you give us. We send requests from the Test Pack to your Assistant and collect its replies. We score the replies and give you a Scorecard with the results per area and, for each failed test, a reference and its area.

4.2Where it runs. We run the test from systems we operate on Google Cloud in the EU. It never runs inside your environment. The requests reach your Assistant through your endpoint, on your key and at your cost (section 7.8).

4.3Scoring. The Scoring Provider scores your Assistant's replies, with the requests that produced them, in the European Union. Section 7.9 explains what this means for your data.

4.4No fee. We charge nothing for a test run.

4.5What a result is. A test run gives you a development signal and a Scorecard. It is not a certification and not legal advice. It is never a pass or fail verdict on your system. Section 13.3 applies.

4.6The test is at version 0. Every test request was written by an AI model and labelled by its author. No human expert in EU law has reviewed them.

4.7No obligation. A test run does not oblige you to buy anything.

4.8Your results stay yours. We do not share your Scorecard or your Assistant's replies with any other customer. Section 11 applies.

5Service 3: Astroware EU AI Act Risk Screening

Anyone can use the Screening Tool without accepting these Terms. This section says what the Screening Tool is and is not.

5.1What it is. Astroware EU AI Act Risk Screening is a free tool on astroware.ai. It is offered as a beta. Anyone can use it without an account.

5.2What it does. It reads the public pages of a website you name, or a one-sentence description you type. It shows which parts of the EU AI Act may apply, and what HaloGuard EU would block. To do this, it sends that text to an external AI service provider. The Privacy Notice explains this.

5.3What it is not. Its results are not legal advice. It is an independent tool by Astroware, not an official EU tool and not the European Commission's EU AI Act Compliance Checker. It never gives a verdict on your system.

5.4Changes. We may change, limit or withdraw the Screening Tool at any time, without notice.

5.5Fair use. Do not try to get around its bot check or its usage limits. Do not use it in bulk or through automated means.

6Accounts and keys

6.1Your details. When you ask for a Service, give us accurate details of your business and a contact person. Tell us when they change.

6.2How Keys are issued. We issue each Key to you privately and show it once. We store only a one-way hash of it and a shortened display (its first three and last four characters), so we cannot recover a lost Key. If you lose one, an owner can revoke it in the console and create a new one.

6.3Keeping Keys secret. Keeping your Keys secure is your responsibility. In particular:

• (a)give a Key only to the people and systems in your business that need it;
• (b)do not put a Key in an app or web page that runs on your users' devices, or in a public code repository; and
• (c)tell us at once, at core@astroware.ai, if you think a Key is lost, exposed or misused.

6.4Use of your Keys. You are responsible for all use of your Keys, and for the fees it causes, until the Key is revoked, by an owner in the console or by us after your request. We revoke a Key promptly after your request. A revoked Key stops working at once.

6.5Your Test Credentials. This section applies only once test runs are available (section 4).

• (a)Enter your Test Credentials only in the console, after you sign in. Never send an API key through the website form, by email, on LinkedIn or in chat. If you do, we will not use it, and you should revoke it.
• (b)Use a key that you can revoke after the test. Where your provider allows it, limit what the key can do and how much it can spend.
• (c)We use your Test Credentials only for the test run. We then delete the key, also if the run fails.
• (d)Revoke the key after the test run, even though we delete it.

6.6People on your account. The account belongs to your business, not to one person. The person who creates it confirms that they may do so for the business (section 1.4). While joining is on, anyone with a verified work email at your company's domain, or at a subdomain of it, can join the account by signing in. Neither you nor we approve each person. Everyone on the account can see the other people's names (if given), email addresses and roles, and the account's Keys (never a full Key), usage and budget. The people on your account are your users. You are responsible for what they do on the account, and for the Keys they create, as for your own use. An owner can remove a person. A removed person can join again by signing in while joining is on. An owner can revoke any Key at any time. When a person is removed or leaves, the Keys they issued are revoked. An owner can restore any of them. We may turn joining off for all customers at any time. That stops new people joining. It does not remove anyone already on the account.

7Free trial and free test runs

Free trial of the HaloGuard EU API

7.1Starting a trial. You can start a free trial yourself in the console. You need a work email address, which we verify by email. We allow one trial for each company email domain, and we do not accept personal or disposable email addresses. We may refuse a trial at any time, and end one on the notice in section 15.5.

7.2What a trial includes. A trial gives your company a USD 5 budget, used at our list price of USD 30 per billion input tokens. Up to 5 active Keys share it, and each Key can send up to 60 requests a minute. A trial has no fixed length. Unused budget has no cash value.

7.3Trial terms.

• (a)The trial keys stop working when the budget is spent, or when the trial ends under section 15.5.
• (b)A trial does not turn into a paid plan unless you accept an Order.
• (c)Use a trial only to evaluate the Service.
• (d)Section 10.3 applies: do not send personal data until the DPA is in force between us.
• (e)We may end a trial on the notice in section 15.5.

Free test runs

Test runs are available only to companies we invite (section 4). Sections 7.4 to 7.14 apply only once we confirm in writing that test runs are available to you.

7.4Your written OK before each run. We start a test run only after you give us a Test-Run Approval for that run. Schedule 1 sets out what it contains. By giving it, you confirm the points in sections 7.5 to 7.11.

7.5Your authority. You confirm that:

• (a)you own or control the Assistant and the endpoint, or you have written permission from the business that does;
• (b)you may let us send our test requests to the Assistant and may accept the costs in section 7.8; and
• (c)the terms of your model provider and your other suppliers allow this testing.

7.6A test or staging setup only. You must point us at a test or staging setup of your Assistant. It must not be connected to live employee or customer data. If your Assistant can take actions, such as sending messages, changing records or calling other systems, turn those actions off or point them at test systems. If your setup still returns personal data, section 7.14 applies to it until the DPA is in force, and the DPA applies after that. Either way, it goes to the Scoring Provider as section 7.9 says.

7.7Sensitive requests. Our test requests are pressure requests. They touch sensitive categories, for example union membership, sexual orientation and emotions. Your Assistant's replies may touch them too. Your logs, filters and monitoring, and your model provider, may record or flag the requests. Tell the people who run your Assistant before the run.

7.8Your cost. A test run sends requests to your endpoint on your key. Every call is made at your cost. Any charge from your model provider, cloud provider or other supplier is yours. We do not pay or refund those costs. Before you approve a run, we show you the expected number of requests and the maximum. The actual number can differ from the expected number, but the run never sends more than the maximum, including retries. The maximum limits the number of requests, not your cost: cost also depends on how long your Assistant's replies are. If you give us a limit on requests per minute, we space the requests evenly at that pace, and retries count towards it. If you do not, we use the default pace shown in the console. A test run is not a load test.

7.9The Scoring Provider.

• (a)We send your Assistant's replies, with the requests that produced them, to the Scoring Provider in the European Union for scoring.
• (b)Under its terms, the Scoring Provider deletes them as soon as it has returned its score. If personal data is found, section 7.14(c) or the DPA says what we do.
• (c)The DPA names the Scoring Provider, summarises its terms and gives your specific authorisation for it. By giving a Test-Run Approval, you confirm that you have read that part of the DPA.
• (d)You may withdraw that authorisation at any time by writing to us. We then run no further test runs for you.

7.10How long we keep run data. We keep your Scorecard for 30 days, then delete it automatically. Ask us at core@astroware.ai to delete it sooner. We use your Assistant's replies only for scoring and do not keep them. The DPA has the detail.

7.11Our test requests in your systems. During a run, our test requests reach your Assistant. Your systems and your model provider may keep copies of them. The test requests are part of the Test Pack and are our Confidential Information. You must not copy, publish or share them, or reuse them to train, tune or test any model or system. Keep them only as long as your normal logs keep them.

7.12Stopping a run. You may withdraw a Test-Run Approval at any time. We then stop the run as soon as we can. We may decline, delay or stop any run, for example if your endpoint fails or if the replies appear to come from a live system.

7.13Ending the free test runs. We may change or stop offering test runs at any time (section 15.5).

7.14Before the DPA is in force. Until the DPA is in force between us (section 10.3):

• (a)a test run is only for a setup that does not return personal data. Section 7.6 applies, and your Assistant must not return personal data in a test run;
• (b)section 7.9(c) does not apply. By giving a Test-Run Approval, you authorise us to send your Assistant's replies, with the requests that produced them, to the Scoring Provider, as section 7.9(a) and (b) say. Section 7.9(d) applies;
• (c)we do not screen replies for personal data before sending them for scoring. If you or we discover or reasonably suspect personal data in a test run, we stop the run without undue delay. No new scoring requests are sent once the stop takes effect, usually within seconds, and we cancel queued requests and retries where technically possible. Requests already in flight may complete. We tell you without undue delay, without waiting for the Scoring Provider, and update you as we learn more. We restrict access to the affected material, and delete the personal data we hold from the run, except where applicable law requires us to keep it. We may keep a minimal incident record, with restricted access, for 12 months after the incident is closed. We promptly ask the Scoring Provider to delete the affected material and to confirm it, and we tell you its answer, or that it gave none. Stopping a run cannot recall material already sent, and we cannot promise deletion from the Scoring Provider's systems beyond what its terms allow. We meet our duties under applicable data-protection law, and nothing in section 7.9(b) limits them. A new run may start only after the cause is fixed, the conditions in this section are met, and you give a new Test-Run Approval; and
• (d)only an owner of your account may give a Test-Run Approval.

8Fees

8.1Price of the HaloGuard EU API. USD 30 per billion input tokens, unless an Order says otherwise. Section 8.2 says what we count.

8.2What we count. We count the tokens in the messages you send. The answer we return is free, and so are the instructions we add to each call. Our gateway's count is used for billing. You can see your usage in the console. If you think a count is wrong, write to core@astroware.ai and we will look at it.

8.3Budgets. Each Key has a budget. When the budget is reached, further calls are refused. A call in progress at that moment can take spend slightly over the budget, by at most about one call. We do not charge for that excess on a free trial. For a paid Service it counts as usage, at the price in section 8.1 or your Order.

8.4Free Services. The free trial (within its budget), the free test runs and the Screening Tool cost nothing.

8.5Other Services. Managed deployment and anything else we agree are priced in an Order.

8.6Payment terms. Payment terms for a paid Service are set in the Order. The Free Services have none.

8.7Currency. Prices, invoices and payments are in US dollars, unless an Order says otherwise.

8.8Taxes. Prices do not include taxes. Where tax applies, the Order or the invoice says how it is shown.

8.9Price changes. We may change a price by notice. A change does not apply to usage before it takes effect. We give 30 days' notice of a price increase. A price cut can take effect at once.

9Customer responsibilities and acceptable use

9.1Your AI system and your legal duties. You stay responsible for:

• (a)your own AI systems;
• (b)how you use the Services and their answers, including what you do when the guard allows or blocks a message; and
• (c)your own legal duties, including under the EU AI Act and the GDPR. This includes deciding whether your AI system is high-risk or falls under a ban.

9.2Your data. You confirm that you have the rights, and any legal basis and notices needed, to send us Customer Data and to let us process it as these Terms and the DPA describe.

9.3Acceptable use. You must not, and must not let anyone else:

• (a)try to extract, copy, reconstruct or reverse engineer the model, its weights, our instructions, its thresholds or the Test Pack, including by sending systematic or high-volume requests for that purpose;
• (b)use the Services or their answers to train or build a model or a test that competes with them;
• (c)use the Services for anything unlawful, including a practice the EU AI Act bans;
• (d)send malicious code, or try to break or get around our security, our Keys, budgets or rate limits;
• (e)access, or try to access, another customer's data or Keys;
• (f)share a Key outside your business, or offer the HaloGuard EU API itself to others as a standalone service, unless an Order allows it;
• (g)load-test, stress-test, scan or security-test the Services without our written consent;
• (h)give us Test Credentials for a system that you may not authorise us to test (section 7.5); or
• (i)use the Services in breach of sanctions or export-control laws that apply to you or to us.

9.4How you describe results. You must not present a Scorecard, or an answer from the HaloGuard EU API, as a certification, as a pass, or as a statement by us that your system meets any law.

9.5Your own customers. If you put HaloGuard EU in front of a product your own customers use, you are responsible for that product and for your relationship with them.

10Data protection

10.1The DPA. When we process personal data on your behalf to provide Service 1 or Service 2, the DPA applies. It forms part of these Terms. To sign the DPA, write to core@astroware.ai. Section 10.3 applies until it is in force.

10.2Our own processing. We also process some personal data for our own purposes, as a controller. Examples: your contact person's details, your account and billing details, the forms on astroware.ai, and the Screening Tool. The Privacy Notice covers that processing, not the DPA.

10.3Before the DPA is in force. Do not send personal data to the Services until the DPA is in force between us.

10.4Usage Data. We use Usage Data only to bill you, to enforce budgets and limits, and to run, secure and fix the Services. We delete Usage Data after 90 days.

10.5No training on your data. We do not use Customer Data to train or improve HaloGuard EU or any other model, or to build our test packs.

10.6The Scoring Provider. Section 7.9 and the DPA apply.

11Confidentiality

11.1What is confidential. Confidential Information is non-public information that one of us gives the other in connection with these Terms. It must be marked confidential, or be information a reasonable person would treat as confidential.

• (a)Ours includes the Test Pack (including test requests that reach your systems in a run), our instructions to the model, our scoring method, our non-public prices and our security details.
• (b)Yours includes Customer Data, your Scorecard, your Test Credentials and non-public information about your systems.

11.2What each of us must do. The party that receives Confidential Information:

• (a)uses it only to provide or use the Services under these Terms;
• (b)protects it with at least reasonable care; and
• (c)shares it only with its staff, advisers and subcontractors who need it for that purpose and who have confidentiality duties at least as strict as these. For us, this includes the sub-processors listed in the DPA, on the terms the DPA describes.

11.3Exceptions. These duties do not apply to information that:

• (a)is or becomes public, other than through a breach of these Terms;
• (b)the receiving party already knew lawfully, without a duty of confidence;
• (c)the receiving party receives lawfully from someone else, without a duty of confidence; or
• (d)the receiving party develops independently.

11.4Disclosure required by law. If the law, a court or a regulator requires disclosure, the receiving party may disclose what is required. Where the law allows, it tells the other party before it discloses.

11.5Your Scorecard. We never share your Scorecard or your Assistant's replies with any other customer.

11.6How long these duties last. They last while these Terms are in force and for three years after they end. For the Test Pack and other trade secrets, they last as long as the information stays confidential.

12Intellectual property

12.1What we own. We and our licensors keep all rights in: the Services; HaloGuard EU and our other models, including their weights; our instructions; the Test Pack; our scoring method; our software and documentation; and any improvements to them. These Terms transfer none of these rights to you.

12.2The Test Pack stays private. We do not disclose the Test Pack, apart from what a Scorecard shows you, the test requests that reach your Assistant during a run (section 7.11), and the examples we publish ourselves.

12.3Your right to use the Services. While these Terms are in force, you may use the Services in your own business. This includes checking the output of products you offer to your own customers. This right is non-exclusive. You may not transfer it or grant it to others, unless an Order allows it.

12.4What you own. You keep all rights in Customer Data: your inputs, your AI system's outputs, your Assistant's replies and your other data. You give us the right to use Customer Data only to provide the Services to you, as these Terms and the DPA describe.

12.5Answers and Scorecards. You may use the answers the HaloGuard EU API returns, and your Scorecard, in your business. You may share your Scorecard with your advisers, auditors and regulators. Section 9.4 applies.

12.6Feedback. If you give us suggestions about the Services, we may use them without any duty to you. This does not cover Customer Data.

13Disclaimers

13.1Not legal advice. No compliance guarantee. The Services are technical tools. They are not legal advice and not a compliance guarantee. They do not make you, or your AI system, meet the EU AI Act, the GDPR or any other law.

13.2HaloGuard EU. HaloGuard EU is a technical control. It does not decide whether your AI system is high-risk. It can miss output it should block, and it can block output that is fine.

13.3Test runs. A test run gives a development signal and a Scorecard. It is not a certification and not legal advice. It is never a pass or fail verdict on your system. It covers only the requests we sent, at the time we sent them, to the setup you named. A test or staging setup may behave differently from your live system.

13.4The Screening Tool. Section 5.3 applies.

13.5No guaranteed outcome. We do not guarantee any detection rate, or any safety or security outcome.

13.6"As is". To the extent the law allows, we provide the Services "as is" and "as available". We make no promise, express or implied, that they will be uninterrupted, free of errors, accurate, or fit for a particular purpose.

13.7Availability. The Services may be unavailable at any time, without notice. We make no commitment on uptime, availability or response time, during a trial or otherwise, unless an Order says so.

13.8Other providers. Your model provider, your cloud provider and other services you use are outside our control. Nothing in this section limits our duties under the DPA for our own sub-processors.

14Liability

14.1What is never limited. Nothing in these Terms limits or excludes any liability that the governing law does not allow to be limited or excluded.

14.2Losses neither of us pays. Neither of us is liable to the other for:

• (a)loss of profit, revenue, business or goodwill;
• (b)loss or corruption of data;
• (c)indirect or consequential loss; or
• (d)fines or penalties that a regulator imposes on the other.

This section 14.2 does not limit your duty to pay fees, or liability for a breach of section 9.3 or section 11, or for infringing the other's intellectual property.

14.3Our total liability. Our total liability to you under or in connection with these Terms, the DPA and all Orders is limited, for all claims in any 12 months, to the greater of (a) the fees you paid us under these Terms in the 12 months before the claim arose and (b) USD 100.

14.4Free Services. For the Free Services, our total liability to you is limited to USD 100.

14.5Certain claims against us. You will compensate us for losses we suffer from a third-party claim that arises from:

• (a)a system you gave us Test Credentials for without authority (section 7.5);
• (b)Customer Data you had no right to send us; or
• (c)your breach of section 9.3.

14.6Reducing loss. Each of us must take reasonable steps to reduce any loss it suffers.

15Term and termination

15.1Start and length. These Terms start when you accept them. They continue until they end under this section. An Order lasts for the period it states.

15.2Ending by you. You may stop using the Services at any time. You may end these Terms by giving us 30 days' notice.

15.3Ending by us. We may end these Terms, or stop a Service, by giving you 30 days' notice.

15.4Ending for a breach or insolvency. Either of us may end these Terms at once, by notice, if the other:

• (a)materially breaches them and does not fix the breach within 14 days of a notice asking it to; or
• (b)becomes insolvent.

We may also end these Terms at once if the law or sanctions require it.

15.5Free Services. We may end any Free Service at any time. Before we end a trial we give you 14 days' notice, unless we end it under section 15.4 or section 16, or the law requires us to stop sooner. For test runs and the Screening Tool we give no notice.

15.6What happens at the end.

• (a)Your right to use the Services stops, and we revoke your Keys.
• (b)You pay any fees due up to the end.
• (c)We delete or return personal data as the DPA says, and as the Privacy Notice says for personal data that we hold as a controller. Deleting data on our side does not by itself delete what the Scoring Provider has already received. Its keeping and deletion follow its terms, applicable law and section 7.14(c).
• (d)Each of us returns or deletes the other's Confidential Information on request. The exceptions are copies the law requires it to keep, and copies in logs until they are overwritten.
• (e)Sections that by their nature should survive do so. These include sections 8 (for fees due), 9.4, 11, 12, 13, 14 and 18.

16Suspension

16.1When we may suspend. We may suspend your access to a Service or a Key, in whole or in part, if:

• (a)you breach section 9.3, or we reasonably suspect a Key is being misused;
• (b)a payment is overdue by more than 14 days;
• (c)we need to stop a security threat, or to protect the Services or other customers; or
• (d)the law, a court or a regulator requires it.

16.2Notice. Where we can, we tell you before we suspend, and say why. Otherwise we tell you promptly after.

16.3Restoring access. We restore access once the cause is resolved.

16.4These Terms continue. A suspension does not end these Terms.

17Changes

17.1Changes to the Services. We may change the Services. If a change materially reduces a paid Service, we tell you in advance, and you may end these Terms before it takes effect. We give you at least 30 days' notice of such a change.

17.2Changes to these Terms. We may change these Terms by notice, given at least 30 days before the change takes effect. If you do not agree, you may end these Terms before then. If you keep using the Services after that date, the change applies to you.

17.3Urgent changes. A change required by law, or needed for security, may take effect sooner.

17.4Sub-processors. Changes to sub-processors follow the DPA.

17.5Prices. Section 8.9 applies.

18General

18.1Governing law. These Terms, and any dispute or claim arising out of or in connection with them, are governed by the laws of the Dubai International Financial Centre (DIFC). The DPA sets its own governing law for the transfer clauses.

18.2Disputes. The courts of the Dubai International Financial Centre (the DIFC Courts) have exclusive jurisdiction over any dispute or claim arising out of or in connection with these Terms. Each of us submits to that jurisdiction.

18.3Notices.

• (a)To us: by email to core@astroware.ai.
• (b)To you: by email to the account owner's address, or to the address in your Order.
• (c)An email notice takes effect when it is sent.

18.4Assignment. You may not assign or transfer these Terms without our written consent. We may assign them, by notice to you, to a group company or to a buyer of our business.

18.5Subcontractors. We may use subcontractors. We remain responsible for them. For personal data, the DPA's rules on sub-processors apply.

18.6Entire agreement. These Terms, the DPA and any Orders are the whole agreement between us about the Services. They replace any earlier agreement or understanding about them. Neither of us relies on any statement that is not in them, for example a website page or a sales message.

18.7Order of precedence. If these documents conflict, this order applies:

• 1.the DPA, for anything about personal data we process on your behalf. The DPA's own rules on precedence apply inside it;
• 2.an Order, but only for the commercial terms it states expressly, such as price, credit, limits and term;
• 3.these Terms;
• 4.anything else we give you in writing about a Service.

An Order cannot change the DPA.

18.8Language. These Terms are in English. If they are translated, the English version prevails.

18.9Events outside our control. Neither of us is liable for a delay or failure caused by events beyond its reasonable control. This does not excuse payment of fees due.

18.10Publicity. We do not name you as a customer, or use your logo, without your written consent.

18.11Independent parties. Each of us is an independent contractor. Neither of us may bind the other.

18.12Rights of others. No one other than you and us has rights under these Terms. The exception is any third-party right that the DPA gives, for example to data subjects under the transfer clauses in the DPA.

18.13Invalid parts. If a court finds part of these Terms invalid, the rest stays in force.

18.14No waiver. A delay in using a right does not waive it.

Schedule 1Test-Run Approval (template)

Free test runs are available only to companies we invite. This form applies only once we confirm in writing that test runs are available to you (section 2.2).

One form for each test run. We start the run only after we receive it.

The Customer confirms that:

• 1.It accepts the Customer Terms of Service, including section 7.14 (test runs before the DPA is in force).
• 2.It owns or controls the Assistant and the endpoint, or has written permission from the business that does, and it may authorise this test (section 7.5).
• 3.The endpoint is a test or staging setup, not connected to live employee or customer data, and it does not return personal data. Any actions the Assistant can take are turned off or point at test systems (sections 7.6 and 7.14).
• 4.It knows that the test requests touch sensitive categories (section 7.7).
• 5.It knows the run sends the number of requests we told it before the run to the endpoint, on its key and at its cost, and that AstroWorks pays none of that cost (section 7.8).
• 6.It knows that AstroWorks sends the replies, with the requests that produced them, to the Scoring Provider in the European Union, which deletes them once it has scored them, and it authorises this (sections 7.9 and 7.14).
• 7.It knows that AstroWorks keeps the Scorecard for 30 days, then deletes it, or sooner if asked. AstroWorks does not keep the replies after the run (section 7.10).
• 8.It will treat the test requests that reach its systems as AstroWorks's Confidential Information (section 7.11).
• 9.The person giving this approval is an owner of the Customer's account and may give it for the Customer.