Terms of Service

These Terms of Service govern access to and use of the Alethexis platform provided by ALETHEXIS, S.L. (Tax ID (NIF) B88758057), with registered office at C/ Tirso de Molina 36, 08940 Cornellà de Llobregat (Barcelona) ("Alethexis"), and the customer organisation that contracts the service ("the Customer").

The Service is intended exclusively for businesses, organisations and professionals acting for purposes relating to their trade, business or profession. The person accepting these Terms represents that they have authority to bind the Customer and are not contracting as a consumer. If mandatory law nevertheless grants a person consumer status, the rights deriving from it are not excluded by this clause.

Alethexis is a SaaS platform for AI and GDPR governance aimed at businesses. It allows AI systems to be inventoried, classified by risk level, policies, assessments and evidence to be documented, and documentation to be generated in support of regulatory compliance.

The plan, the billing cycle (annual or monthly), the users included, the add-ons (Agentic Add-on, additional users) and the price applicable are those shown in the order or checkout accepted by the Customer. Prices are stated exclusive of indirect taxes. The Customer shall provide the tax details required, including the VAT identification number where applicable; Alethexis will apply the VAT treatment required by applicable law. The reference prices published on the pricing page may be updated for future periods in accordance with clause 3 ter.

The annual cycle is paid by SEPA Direct Debit or bank transfer; the monthly cycle by card. Fees are charged in advance for the period contracted. In the annual cycle Alethexis may activate access upon signature of the mandate or issuance of the invoice, before payment is confirmed; if payment is not confirmed within the period stated in the product, the subscription is cancelled and the deletion policy of the Data Processing Agreement applies. If a payment fails, Alethexis may retry it and, after notice, limit or suspend access; suspension does not extinguish amounts already accrued.

The subscription renews automatically for successive periods of equal duration, at the price in force on the renewal date, unless cancelled before that date from the billing portal. Cancellation takes effect at the end of the period paid for; pro-rata amounts for periods already started are not refunded, save for a legal obligation, a billing error or an express undertaking. Alethexis will give at least 30 days' notice of any price change before the renewal to which it applies. An upgrade is pro-rated; a downgrade does not delete data and preserves read-only and export access to the sections that cease to be included, for the period paid for.

Alethexis offers a 14-day free trial with no payment method, activated on completion of the initial setup. The trial does not convert into a paid subscriptionunless the Customer expressly contracts a plan. When the trial ends without a contract, access ceases and the data is handled in accordance with the deletion policy of the Data Processing Agreement, with the grace period provided for therein.

The Customer undertakes to use the platform in accordance with the law and with these terms, not to introduce unlawful content, to safeguard its credentials and to be responsible for the activity of the users of its account. Alethexis may suspend access in the event of use that compromises the security or integrity of the service.

(a) API keys. The Customer is responsible for safeguarding the read API keys it generates and for revoking them without delay when they are no longer needed or when it suspects they have been compromised. Each key is shown only once, when it is created, and cannot be consulted again: if it is lost, it is revoked and another is created. All activity carried out with a key is attributed to the Customer.

(b) Usage limits. The Service applies rate and volume limits to the API, as set out in its documentation. Alethexis may suspend or revoke a key whose use compromises the availability or security of the Service, informing the Customer.

(c) Notification recipients. The Customer designates and configures the addresses that receive its outbound notifications, and is responsible for their security — including the encrypted channel, verification of the signature of each delivery and access control of the receiving system — and for the legal relationship it has with whoever operates it.

A recipient designated by the Customer is not a sub-processor of Alethexis: Alethexis merely sends it the notification on the Customer's instruction. Its own status — processor of the Customer, independent controller or otherwise — depends on its relationship with the Customer.

(d) Content of the notifications. Outbound notifications carry the event type, identifiers, a status and a timestamp. To obtain the detail, the recipient queries the authenticated API. There are no fields intended to contain personal data.

(e) Personal data in fields not intended for it. The Customer undertakes not to enter personal data in fields not intended to contain it — names of systems, tools, providers, labels and the like. Naming a system after a person turns a field the Service treats as technical into personal data, in the interface, in the API and in the notifications.

(f) External auditors. The Customer is responsible for authorising each auditor, for deciding what they may consult and for ensuring that an adequate legal and confidentiality relationship exists with them. Access always expires — 7, 30 or 90 days —, the Customer may revoke it at any time and may grant it with or without download.

(g) Federated authentication. If the Customer configures single sign-on, it engages and administers the identity provider itself. Alethexis does not create accounts from that identity: only someone already invited to the organisation can sign in.

Alethexis will use reasonable means, in accordance with the state of the art, to keep the Service operational and accessible on a continuous basis. The Service does not have a contractual Service Level Agreement (SLA) with financial compensation in the M1, M2 and M3 plans of this launch phase; Alethexis may offer a formal SLA as an additional option for Enterprise customers in the future.

Scheduled maintenance tasks will be communicated with a minimum of 48 hours' notice, except for urgent maintenance for security reasons, in which case notice will be given as soon as possible.

The platform is a methodological support tool. It does not constitute legal advice, nor does it replace the roles, decisions and obligations that the applicable legislation assigns to the Customer. Ultimate regulatory compliance is the responsibility of the Customer.

To the maximum extent permitted by applicable law, the total and aggregate liability of Alethexis towards the Customer for any claim arising from or relating to these Terms or the Service is limited to the amount actually paid by the Customer to Alethexis in the twelve (12) months preceding the event giving rise to the claim.

Neither Party shall be liable to the other for indirect damages, loss of profit, loss of data or loss of business, except in cases of wilful misconduct or gross negligence.

This limitation does not apply: (i) to cases of wilful misconduct or gross negligence; (ii) to breach of confidentiality obligations; or (iii) to liability arising from the processing of personal data, which is governed by the Data Processing Agreement (DPA).

The software, the trade mark, the design and the methodological contents of the platform are owned by Alethexis. The Customer retains ownership of the data and documents it enters into or generates with the platform.

The processing of personal data is governed by the Privacy Policy and, where Alethexis acts as processor of the Customer's data, by the Data Processing Agreement (DPA) which forms part of the contract.

The activation of the integrations described in clause 5 bis — API keys, notification recipients, identity provider and external auditor access — constitutes a documented instruction of the Customer for the purposes of Article 28 GDPR and of that Agreement.

The contract remains in force for the duration of the subscription and its renewals. Either party may terminate it for a material breach not remedied after written notice, or immediately if the breach cannot be remedied. On termination, the Customer may export its data during the grace period and the personal data processed by Alethexis as processor is returned or deleted in accordance with clause 10 of the Data Processing Agreement.

These Terms are governed by Spanish law and by directly applicable European Union law. For contractual disputes, the parties submit to the Courts and Tribunals of Barcelona, to the extent permitted by applicable law and without prejudice to the powers of administrative and data protection authorities.

The Terms are offered in Spanish and English; both versions form part of the contractual framework and state the same terms. In the event of a discrepancy, the Spanish version prevails, without prejudice to mandatory rules. The order, these Terms and the DPA constitute the applicable agreement; in matters of processing on behalf of the Customer, the DPA prevails.

Read the Spanish version