Terms of Service

Version 1.0 · Last updated 21 September 2026 · English is the binding version of these Terms.

If you are here because you were chatting with an assistant — on a website, on Instagram, on Messenger, on Telegram or by e-mail — the part written for you is section 15, Using the AI assistant. It is short and in plain language. The rest of this document governs our contract with the business you contacted.

Part I — General

1. Who we are

The Service is provided by SDH IT GmbH, Anckelmannplatz 1, EG, Aufgang C, 20537 Hamburg, Germany.

Represented by the managing director: Vasyl Kuchma

Commercial register: Amtsgericht Hamburg, HRB 140320

VAT identification number: DE306650237

Telephone: +49(0)4023608920 · E-mail: info@sdh-it.com

Further details are in our imprint, and our privacy policy explains how we handle personal data. In these Terms, SDH, we and us mean SDH IT GmbH.

2. What these Terms cover

2.1 These Terms govern access to and use of AI Intake Agent (the Service) — a hosted software service that lets a business run an AI assistant on its own communication channels: a website chat widget, Telegram, Instagram Direct, Facebook Messenger, and e-mail.

2.2 Two groups of people meet the Service, and these Terms address them separately:

• a Business Customer — the business that licenses the Service from us and connects its own channels (Parts I, II and IV, together with its Order Form and Annex 1);
• an End User — a person who writes to one of those channels and is answered by the assistant (Part I and section 15).

2.3 The Service is offered to businesses only. We do not contract with consumers within the meaning of § 13 BGB. An End User does not enter into a contract with us by using the assistant; section 15 sets out what applies to them.

2.4 Where the parties have signed an order form, offer, or framework agreement (the Order Form), the order of precedence is: (a) the Order Form, (b) Annex 1 (Data Processing Terms) or any separate data processing agreement, (c) these Terms, (d) the product documentation. Terms and conditions of the Business Customer do not apply, even if we do not expressly object to them and even if we perform without reservation.

2.5 Meta Platforms Ireland Limited, Telegram, and any e-mail or infrastructure provider are independent third parties. They are not parties to these Terms, and the Service is neither sponsored nor endorsed by them.

3. The Service — what it does, and what it does not

3.1 The Service holds a conversation with a person who writes in, understands a free-form enquiry, extracts the details the Business Customer needs, checks the enquiry for completeness, applies deterministic rules the Business Customer has configured, and hands a structured summary to that Business Customer's staff. Where the Business Customer enables it, the assistant also answers questions from a knowledge base the Business Customer supplies.

3.2 The Service is an intake and orientation tool. It does not provide, and must not be presented as providing, legal, medical, insurance, immigration, tax or financial advice.

3.3 In particular, the Service:

• does not diagnose, does not interpret medical images, studies or findings, and is not a medical device within the meaning of Regulation (EU) 2017/745 — it is not intended for the diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease;
• does not decide insurance cover, liability, deductibles or payment, and no output of the Service is a coverage decision or a settlement offer;
• does not give legal advice, does not represent anyone before any authority, and cannot guarantee the grant of a visa, permit or status — those decisions belong to the competent authority alone;
• makes no decision based solely on automated processing that produces legal effects concerning a person or similarly significantly affects them within the meaning of Article 22 GDPR. Every outcome is reviewed and released by a human being at the Business Customer.

3.4 Not for emergencies. Conversations are not monitored in real time and the Service must not be used to report an emergency of any kind. In the European Union, call 112.

3.5 It is an AI system. Replies are generated by large language models. Such output is probabilistic: it can be inaccurate, incomplete or out of date, and it can be wrong while reading as confident and specific. Output is a draft for human review, never a statement of fact, never advice, and never a binding declaration on behalf of anyone. We do not warrant the accuracy, completeness or fitness of any output for any particular decision. Section 17 applies.

3.6 Transparency. The assistant identifies itself as an AI system when it interacts directly with a natural person, in line with Article 50(1) of Regulation (EU) 2024/1689 (the AI Act). Neither party may configure or operate the Service so that it denies being an AI system, or so that it presents itself as a specific, identifiable human being.

Part II — Terms for Business Customers

4. Contract, accounts and pilots

4.1 A contract comes into existence when you sign or confirm an Order Form in text form, or when you first use in production an account we have provisioned for you.

4.2 Pilots and trials. Where the Service is provided free of charge or at a reduced pilot fee, either party may terminate with immediate effect at any time, no availability level is owed, and our liability is governed by section 17.1 alone — that is, limited to intent, gross negligence, injury to life, body or health, guarantees given, and mandatory statutory liability.

4.3 Accounts. Accounts are issued to named individuals and may not be shared. You are responsible for everything done through your accounts, for keeping credentials confidential, for using the roles the Service provides rather than granting everyone manager rights, for removing access when a person leaves, and for telling us without undue delay if you suspect a credential has been compromised.

5. Licence and permitted use

5.1 For the term of the contract and subject to payment of the agreed fees, we grant you a non-exclusive, non-transferable, non-sublicensable right to use the Service for your own business purposes, for the configurations and channels named in the Order Form.

5.2 You will not, and will not permit anyone else to:

• decompile, disassemble or otherwise reverse engineer the Service, except to the extent § 69e UrhG permits and only after asking us for the information first;
• extract, copy or publish the system prompts, instructions, validation rules or templates that make up the Service;
• use the Service, or its output, to develop, train or fine-tune a competing model or a competing service;
• resell, rent out, or operate the Service for third parties, or present it as your own product, unless we have agreed that in writing;
• access the Service by automated means outside the documented interfaces, or circumvent rate limits, usage caps or security controls.

5.3 Benchmark or performance test results concerning the Service may not be published without our prior written consent.

5.4 We develop the Service continuously and may change it. If a change materially reduces functionality that the Order Form expressly promises, you may terminate the affected part of the contract with one month's notice, from the date the change takes effect.

6. Your responsibilities

This section is the heart of the arrangement: the Service supplies the mechanism, you supply the content, the configuration and the professional judgement.

6.1 Lawful basis. You are the controller for all personal data processed through the Service in the course of your conversations. You warrant that you have a lawful basis for that processing, including a basis under Article 9(2) GDPR wherever special categories of data — data concerning health above all — are involved, and that your own records of processing reflect it.

6.2 Telling people. You will state in your own privacy notice, and wherever else the law requires, that an AI assistant handles the conversation, who the controller is, what happens to the data, and how a person exercises their rights. You will keep that information accurate as your configuration changes.

6.3 A human decides. You keep a suitably qualified human being responsible for every decision, quotation, assessment or statement of substance that follows from an enquiry, and that person reviews the output before it is acted on or passed to anyone else. You will not configure the Service to issue binding offers, legal or medical statements, or decisions automatically.

6.4 Your content. You are solely responsible for the content of your knowledge base, your prompt overrides, your field and validation configuration, your message and e-mail templates, and every document uploaded through your account, and you warrant that you hold the rights needed to use them.

6.5 Your sector's rules. You remain responsible for your own regulatory, professional and licensing obligations — among them medical confidentiality (including § 203 StGB where it binds you), professional rules for lawyers and legal advisers, insurance distribution rules, and the rules governing immigration advice — and for holding any authorisation your own activity requires. We do not advise you on them and do not assume them.

6.6 Channel rules. You connect only accounts, Pages, bots and mailboxes you are entitled to connect, and you comply with the rules of each platform you connect — including the Meta Platform Terms, the Meta Developer Policies, the Messenger and Instagram messaging policies and their messaging windows, and Telegram's terms. You will not use the Service to send unsolicited or bulk messages, and you will obtain any consent required under Directive 2002/58/EC and § 7 UWG before sending anything promotional.

6.7 Prohibited use. You will not use the Service:

• for any practice prohibited by Article 5 of the AI Act, including social scoring, manipulative or exploitative techniques, inferring emotions in the workplace or in education, and biometric categorisation by protected characteristics;
• to profile, rank or score individuals on the basis of special categories of personal data;
• to impersonate a public authority, a named individual, or a licensed professional;
• to generate or spread unlawful, defamatory, discriminatory or infringing content;
• knowingly to process the data of a child below the age of digital consent (16 in Germany, Article 8 GDPR) without the consent required;
• to obtain from the model the advice or decisions the Service is expressly not intended to give (section 3), or to circumvent the safeguards built into it.

6.8 Substantial modification. If you put the Service on the market under your own name or brand, or change its intended purpose, you may yourself become a provider of an AI system under Article 25 of the AI Act and assume the corresponding obligations. You will tell us before doing either.

6.9 Cooperation. You provide the information, access and decisions we reasonably need. Where a delay is attributable to you, our own deadlines are extended accordingly.

7. Platforms, channels and AI models

7.1 The Service depends on third parties: messaging platforms, cloud infrastructure, and AI model providers. Their availability, policies, interfaces, pricing and approval processes are outside our control.

7.2 Access to Instagram Direct and Facebook Messenger in particular depends on Meta's app review, on the permissions Meta grants, and on Meta's messaging windows. We do not warrant that any permission will be granted or kept, that any interface will remain available, or that a message can be delivered outside a platform's window.

7.3 If a platform requires it, or if continued operation would breach a platform's rules or the law, we may suspend or disable the affected channel with immediate effect. We will tell you without undue delay and restore the channel as soon as we properly can. This is not a breach of these Terms.

7.4 A third party's change, outage, rate limit, policy decision or withdrawal of an interface is not a defect of the Service.

7.5 Model providers. Replies are generated using third-party large language models (Annex 2). We use those providers on their business and enterprise terms, which do not permit them to train their models on the content we send. Providers may retain inputs and outputs for a limited period for security and abuse monitoring; we do not use your content to train any model of our own.

8. Fees, invoicing and payment

8.1 Fees are those in the Order Form. All amounts are net of value added tax, which we add at the applicable rate; where the reverse charge applies you provide a valid VAT identification number and account for the tax yourself.

8.2 Invoices are payable within 14 days of the invoice date without deduction. In default you owe interest at 9 percentage points above the base rate under § 288(2) BGB, plus the flat charge under § 288(5) BGB. We reserve the right to prove higher damage.

8.3 Usage-dependent charges — AI model usage, messages, storage — are billed as set out in the Order Form. Budget ceilings and usage caps offered in the Service are a cost-control aid, not a guarantee that a limit will never be exceeded.

8.4 We may adjust fees with two months' notice in text form, effective no earlier than the start of the next renewal term. If we do, you may terminate the affected service to the date the new fee would take effect.

8.5 You may set off only against claims that are undisputed or have been finally determined by a court, and may exercise a right of retention only in respect of claims arising from the same contractual relationship.

9. Availability, support and maintenance

9.1 We operate the Service with the care of a prudent provider. Unless an availability level is agreed in the Order Form, no specific availability is owed.

9.2 Planned maintenance is announced in advance where practicable and placed outside German business hours where we can. Security fixes and emergency maintenance may be applied immediately.

9.3 Support is provided through the channel named in the Order Form, on German business days.

9.4 Periods attributable to a third-party outage (section 7), to force majeure (section 19), or to a cause within your sphere do not count against any agreed availability.

10. Intellectual property

10.1 All rights in the Service — software, interfaces, prompts, templates, validation rules, documentation — and in any further development of it remain with us or our licensors. Nothing in these Terms transfers them.

10.2 Your data — conversations, documents, configuration, knowledge base (Customer Data) — remains yours. You grant us the non-exclusive right to use it solely to provide, secure and support the Service and to comply with the law.

10.3 We do not use Customer Data to train our own models or those of third parties (section 7.5).

10.4 As between the parties, output generated for you through your account is allocated to you, to the extent it is protectable at all. You acknowledge that output of an AI system may not attract copyright protection and may not be unique to you.

10.5 If you send us suggestions or feedback about the Service, we may use them without restriction and without owing you anything.

11. Confidentiality

11.1 Each party keeps confidential the other's information that is marked as confidential or is evidently confidential from its nature, uses it only for the purposes of the contract, and discloses it only to those who need it and are themselves bound to confidentiality.

11.2 This does not apply to information that is public without breach, was already lawfully known, was independently developed, or must be disclosed by law or by order of a court or authority — in which case the disclosing party informs the other in advance where it lawfully may.

11.3 These obligations survive for three years after the end of the contract; obligations of professional secrecy and of data protection survive for as long as the law requires.

12. Data protection

12.1 You are the controller and we are the processor for the personal data processed in your conversations. Annex 1 forms part of these Terms and is the agreement required by Article 28(3) GDPR. If the parties sign a separate data processing agreement, that agreement prevails.

12.2 We are a controller in our own right for account, authentication, billing, security-log and aggregated usage data. We process it as described in our privacy policy.

12.3 Retention is configurable and documented. By default, stored model request and response texts are purged after 30 days, and the text of knowledge-base search queries after 90 days; conversation and request records are kept for as long as you configure or as long as the contract runs, subject to section 13.4.

12.4 If a data subject approaches us with a request concerning your conversations, we forward it to you without undue delay and do not answer it on your behalf unless you instruct us to.

13. Term, termination, suspension and switching

13.1 The contract runs for the initial term in the Order Form and renews for successive terms of the same length unless terminated with one month's notice to the end of the then-current term. If the Order Form states no term, the contract runs for one month and renews monthly on the same notice.

13.2 The right of either party to terminate for good cause under § 314 BGB is unaffected. Good cause includes, for us, a material breach not cured within 14 days of notice, repeated default in payment, and use that violates section 6.7.

13.3 Suspension. We may suspend access in whole or in part where (a) fees are more than 21 days overdue after a reminder, (b) use endangers the security or integrity of the Service or of other customers, (c) use is manifestly unlawful or breaches section 6.7, or (d) a platform, a court or an authority requires it. We notify you, limit the suspension to what is necessary, and lift it once the cause is removed. A suspension under (a) to (c) does not reduce the fees.

13.4 Export and deletion. For 30 days after the contract ends we keep Customer Data available to you for export in a structured, commonly used, machine-readable format. After that we delete it, save for backup copies deleted on their ordinary rotation and data we are required by law to keep.

13.5 Switching (Data Act). To the extent the Service is a data processing service within the meaning of Regulation (EU) 2023/2854, you may request switching to another provider or termination with a notice period of at most two months. The transitional period is 30 days, extendable where it is technically necessary under Article 25(4). We provide the assistance, the information and the exportable data Chapter VI of that Regulation requires, and we charge nothing for switching beyond what Article 29 permits. This runs in parallel with section 13.4.

14. Changes to these Terms

14.1 We may amend these Terms with effect for the future, on at least 30 days' notice in text form, where the amendment is needed to reflect a change in the law, in case law, in the rules of a platform we depend on, or in the functionality of the Service, and where it does not disturb the balance of the contract in our favour.

14.2 You may object in text form before the change takes effect. If you object, either party may terminate the contract to that date; if you do not, the change takes effect. Our notice will set out the change, the deadline, your right to object and the consequence of silence.

14.3 The version in force is the one published on this page. Earlier versions are available from us on request.

Part III — For people using the assistant

15. Using the AI assistant

15.1 You are talking to an AI. The assistant is software operated by SDH IT GmbH on behalf of the business whose website, Page, Instagram account, Telegram bot or mailbox you contacted. That business — not SDH — is responsible for its own services and is the controller of your personal data.

15.2 What it is for. Understanding what you need, collecting the details that business requires, and passing a tidy summary to a member of its staff. A person there takes it from that point.

15.3 What it is not. It is not advice. It does not diagnose, does not read or interpret medical studies, does not decide insurance claims, does not give legal advice, and cannot promise you a visa or a permit. Nothing it writes is a professional opinion, a decision, or a binding offer, and it can be wrong even when it sounds certain. Please check anything important with the business itself.

15.4 Emergencies. Do not use the chat to report an emergency. Nobody is watching it around the clock. In the European Union, call 112. If you are in immediate danger or in a medical crisis, contact the emergency services or go to the nearest emergency department.

15.5 Send only what is needed. Share the details relevant to your enquiry and no more. Never send passwords or payment card details. Do not send documents containing other people's personal data unless you are entitled to.

15.6 A person may be reading. Staff at the business you contacted can read the conversation, join it, and continue it themselves. The assistant will usually step aside when that happens.

15.7 Age. The assistant is meant for people aged 16 or over, or the age of digital consent in your country, unless a parent or guardian consents.

15.8 Your data and your rights. The business you contacted decides why and how your data is processed, and its privacy notice explains that and tells you how to exercise your rights of access, rectification, erasure, restriction, objection and portability (Articles 15–21 GDPR), as well as your right to complain to a supervisory authority. We process the conversation on that business's instructions. If you write to us instead, we will pass your request on without undue delay. Our own privacy policy explains what we do with data of our own, and you can reach us at info@sdh-it.com.

15.9 The messaging app itself. If you wrote from Instagram, Messenger or Telegram, that platform's own terms and privacy policy govern how it handles your message. We cannot change that, and this document does not replace it.

15.10 Please do not misuse it. No unlawful content, no attempts to extract the assistant's instructions or break its safeguards, no automated flooding. We may rate-limit or block traffic that does any of these.

15.11 Chatting with the assistant does not create a contract between you and SDH. Parts II and IV govern our relationship with the business, and nothing in them limits our statutory liability towards you.

Part IV — Common provisions

16. Warranty

16.1 We owe the Service in the condition described in the documentation and the Order Form. The statutory warranty applies, with the modifications below.

16.2 Liability irrespective of fault for defects already present when the contract was concluded, under § 536a(1), first alternative, BGB, is excluded. Our liability for such defects requires fault and is otherwise governed by section 17.

16.3 An insignificant reduction in usability is not a defect. A defect is a deviation that materially impairs the agreed use.

16.4 Output of an AI model that turns out to be factually wrong, incomplete or unsuitable is not, in itself, a defect of the Service, provided the Service operates as described. Sections 3.5 and 6.3 apply.

16.5 You report defects in text form, with enough detail for us to reproduce them, and cooperate in their analysis.

17. Liability

17.1 We are liable without limitation:

• for intent and gross negligence;
• for injury to life, body or health;
• under the German Product Liability Act (Produkthaftungsgesetz);
• where we have fraudulently concealed a defect; and
• to the extent we have given a guarantee.

17.2 In cases of slight negligence we are liable only for breach of a material contractual obligation — an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose fulfilment the other party may regularly rely. In that case our liability is limited to the damage typical for this kind of contract and foreseeable at the time the contract was concluded.

17.3 Liability under section 17.2 is limited, per contract year, to the fees you paid in the twelve months preceding the event giving rise to the claim, and in any event to EUR 10,000 per contract year.

17.4 Liability for loss of data is limited to the effort that would have been required to restore it had you made regular, risk-appropriate backups.

17.5 Any further liability is excluded. In particular, and subject always to section 17.1, we are not liable for:

• decisions you or a third party take on the basis of output of the Service, or for acting on such output without the human review section 6.3 requires;
• the content of your knowledge base, your prompts or your configuration;
• your compliance with your own regulatory, professional or licensing obligations;
• the acts, omissions, policy changes or outages of a platform or other third party under section 7.

17.6 The above limitations apply equally in favour of our corporate bodies, employees, agents and other persons we use in performing the contract.

17.7 Claims for damages under section 17.2 become time-barred twelve months after you become aware of the damage and of the circumstances giving rise to the claim, and in any case 24 months after the event. The statutory limitation periods apply to claims under section 17.1 and to fraudulently concealed defects.

18. Indemnity

18.1 You will indemnify us against third-party claims, including the reasonable costs of legal defence, that arise from (a) content, data or configuration you supplied, (b) your breach of section 6, (c) your breach of a platform's rules, or (d) your own regulatory or professional obligations — unless you are not responsible for the breach.

18.2 We will inform you of any such claim without undue delay, will not acknowledge it without your agreement, and will give you the opportunity to conduct the defence.

19. Force majeure

19.1 Neither party is in breach for a delay or failure caused by an event beyond its reasonable control — including war, acts of terrorism, natural disaster, epidemic, energy shortage, an industrial dispute not confined to its own workforce, an act of a public authority, a failure of public telecommunications, or a cyber-attack on infrastructure it does not operate. The affected party informs the other and does what it reasonably can to limit the effect.

19.2 If such an event lasts longer than two months, either party may terminate the affected part of the contract in text form.

20. General

20.1 You may not assign the contract or rights under it without our consent, which we will not unreasonably withhold. We may assign it to an affiliate or in connection with a transfer of the business to which it relates.

20.2 We may use subcontractors and remain responsible for their performance as for our own. Sub-processors of personal data are governed by Annex 1.

20.3 Notices may be given in text form, including by e-mail to the addresses named in the Order Form. Notices of termination require text form.

20.4 The Order Form, these Terms and their annexes contain the entire agreement between the parties on their subject matter. There are no side agreements.

20.5 Should any provision be or become invalid, the validity of the remainder is unaffected. The parties will replace the invalid provision with a valid one that comes closest to its commercial purpose.

20.6 We may name you as a reference customer and use your logo for that purpose only with your prior written consent.

21. Governing law and jurisdiction

21.1 These Terms and the contract are governed by German law, excluding the United Nations Convention on Contracts for the International Sale of Goods and excluding conflict-of-law rules.

21.2 If you are a merchant, a legal person under public law or a special fund under public law, the exclusive place of jurisdiction for all disputes arising out of or in connection with the contract is Hamburg, Germany. We may also bring proceedings at your general place of jurisdiction.

21.3 Mandatory provisions of the law of the country in which an End User has their habitual residence remain unaffected.

21.4 We are neither obliged nor willing to take part in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).

Annex 1 — Data Processing Terms (Article 28 GDPR)

The agreement required by Article 28(3) GDPR, between the Business Customer as controller and SDH IT GmbH as processor.

A1.1 Subject matter, nature and purpose. We process personal data on your behalf in order to operate the AI assistant on your channels: receiving and answering messages, extracting and structuring enquiry data, reading documents you or your customers upload, searching your knowledge base, notifying your staff, and composing the summaries your staff approve. The processing lasts for the term of the contract and the export window in section 13.4.

A1.2 Categories of data subjects and data.

• Your customers, enquirers and prospective clients — identity and contact details; the content of their messages and attachments; the structured enquiry fields you have configured; the channel identifier they wrote from; language; timestamps.
• Your staff and other authorised users — name, e-mail address, role, authentication and audit records.
• Third parties named in a message or document — whatever the sender chose to include.
• Special categories under Article 9 GDPR, in particular data concerning health — processed only because your own use case requires it, and only on your instructions.

A1.3 Instructions. We process personal data only on your documented instructions, including as regards transfers to a third country, unless we are required to do otherwise by Union or Member State law — in which case we inform you before processing, unless that law prohibits it. These Terms, the Order Form and your configuration of the Service are your instructions. We will inform you if, in our opinion, an instruction infringes data protection law.

A1.4 Confidentiality. Persons authorised to process the data are bound to confidentiality and trained accordingly. Where you are subject to professional secrecy, we and the persons we use undertake to secrecy in accordance with § 203(4) StGB on your request.

A1.5 Security of processing (Article 32). We maintain technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS) for every connection between the Service, its data stores and the platforms it talks to, and encryption at rest by our infrastructure providers;
• per-tenant separation: every read of conversation data and of the knowledge base is scoped to one organisation, and that scope is required rather than optional;
• channel credentials and platform tokens stored encrypted with AES-256-GCM under a per-organisation key that is itself wrapped by a master key held only in the runtime environment, so a database copy alone decrypts nothing; the administration interface never returns a stored secret;
• role-based access control, with configuration and knowledge-base changes restricted to manager roles, and an append-only audit trail of administrative actions;
• error monitoring configured not to transmit request bodies or stack-frame variables, with recursive scrubbing of credential-shaped values;
• retention windows that erase stored model texts and search-query texts automatically (section 12.3);
• backups maintained by our database provider, and restoration procedures for the Service as a whole.

A1.6 Sub-processors. You grant general written authorisation for the sub-processors listed in Annex 2. We impose on each of them data protection obligations equivalent to those in this Annex and remain fully liable to you for their performance. We will give you at least 30 days' notice in text form before adding or replacing a sub-processor; you may object on reasonable data-protection grounds, and if we cannot accommodate the objection you may terminate the affected service to the date the change takes effect, without penalty.

A1.7 International transfers. The Service and its data stores are operated in the European Union. Where a sub-processor is established outside the EEA, transfers are made under an adequacy decision or, failing that, under the European Commission's Standard Contractual Clauses together with a transfer impact assessment and any supplementary measures that assessment requires.

A1.8 Assistance. Taking into account the nature of the processing and the information available to us, we assist you with appropriate measures in fulfilling your obligation to respond to data subject requests, and with your obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation. We may charge for assistance that goes materially beyond the functions the Service already provides, at our then-current rates.

A1.9 Personal data breach. We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information available to us at the time, and supplement it as the investigation proceeds.

A1.10 Deletion and return. On the end of the processing we delete or return the personal data at your choice, in accordance with section 13.4, unless Union or Member State law requires us to store it.

A1.11 Audit. We make available the information necessary to demonstrate compliance with this Annex, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate who is not our competitor and is bound to confidentiality. Audits take place once per calendar year and additionally after a personal data breach, on reasonable notice, during business hours, and without disproportionate disruption. We may discharge an audit by providing a current certification or an independent audit report where it covers the matter in question.

Annex 2 — Sub-processors

Current as at the date of this document. Changes are notified under A1.6.

• Google Cloud — application hosting, background job queue, and object storage for uploaded documents. Processed in europe-west3, Frankfurt, Germany.
• Neon — managed PostgreSQL database holding conversations, requests and configuration. Processed in eu-central-1, Frankfurt, Germany.
• Qdrant — managed vector database holding the knowledge-base search index. Processed in eu-central-1, Frankfurt, Germany.
• Upstash — managed cache for short-lived session state and rate-limit counters. Processed in a European Union region.
• Anthropic — the large language model that generates the assistant's replies. Processed in the United States under Standard Contractual Clauses.
• OpenAI — an alternative large language model, where a Business Customer selects it. Processed in the United States under Standard Contractual Clauses.
• Sentry — error monitoring, configured to exclude request bodies and variable contents. Processed in a European Union region.

Meta and Telegram are not our sub-processors. They are the messaging platforms your customers already use, and they process a message under their own terms with the sender, before and after it reaches us. The same applies to the mail server behind a mailbox you connect: it is yours, and your relationship with its provider is yours.

Contact

If you have any questions about these Terms, write to info@sdh-it.com.