Terms

Us: NeoProject d.o.o., Prušnikova ulica 2, 1210 Ljubljana-Šentvid, Slovenia. Registration number 3887995000, tax number 88766446.

You: the company whose account it is. Whoever accepts an invitation or signs in uses the service for that company, and the company answers for what its people do in it.

If your company came to us through a reseller, the price, invoicing and first-line support are agreed with that reseller. These terms still govern the service itself and how we handle your data. Where an agreement your company has signed with us says something different, the signed agreement wins.

A console, a workflow engine and hosted AI agents that work with your company’s own systems. We keep developing it, so features change. When a change takes away something your company relies on, we tell your admins at least 30 days ahead, unless a security problem or the law leaves no time.

We do not promise uninterrupted availability unless a signed agreement does. We carry out maintenance with as little disruption as we can.

Fees are whatever your order with us or your reseller says. The usage and cost figures in the console are there to help you keep an eye on spending; they are not an invoice.

• Your company decides who gets in and what they may do, and is responsible for what they do.
• Passwords, API keys and connector secrets are to be kept secret. Calls made with them count as your company’s. We strongly recommend two-factor sign-in for everyone, and for admins above all.
• If you think an account or a key has been compromised, tell us at once at info-victor@neoproject.ai.

The AI models, mailboxes, CRMs and other services your company connects are used under your company’s own accounts. That is your contract with each provider, under their terms and on their bill, including what a model provider may do with the prompts it receives. We are not responsible for their availability, their charges or what they return.

Agents and workflows produce content with AI models. It can be wrong, incomplete or unsuitable, however confident it sounds. Your company decides what an agent may do on its own, and checks anything that matters before relying on it. Nothing the service produces is legal, financial, medical or other professional advice from us.

Where an agent writes or speaks to people, your company makes sure they know they are dealing with an AI wherever the law requires it, including Article 50 of the EU AI Act, and does not present it as a person.

The service may not be used to make decisions with a legal or similarly significant effect on a person without a human reviewing them, nor for any practice the AI Act prohibits or classes as high-risk, unless we have agreed it in writing.

• Anything unlawful, or that infringes somebody else’s rights.
• Spam, or messages to people who have not agreed to receive them.
• Data your company has no right to process, and — unless we have agreed it in writing — special categories of personal data (such as health, biometric or political data) or data about criminal convictions.
• Reaching data that belongs to another company, testing the service’s security without our written permission, or getting around its limits.
• Attacking, scanning or overloading other systems, or spreading malware, through workflows or otherwise.
• Giving access to anybody outside your company, unless you are a reseller with an agreement with us that allows it.
• Copying or reverse-engineering the service, except where the law allows it regardless of what a contract says.

What your company puts into the service, and what its agents and workflows produce, is your company’s. You let us store, process and send it only as far as needed to run the service for you, keep it secure and fix it when something breaks. We do not sell it, show it to other customers or train AI models on it.

What a workflow or an agent ran on is kept for three months in the hub and two weeks in the workflow engine, then deleted. Workflows, agents, indexed documents and data tables stay until your company deletes them. The service is not an archive: keep your originals in your own systems.

We use metadata about how the service is used — counts, timings, errors, tokens spent — to run and improve it, never the content itself.

For the personal data inside your workflows and agents — a ticket, a lead, an email, a document — your company is the controller and we are its processor. The data about your people’s own accounts is ours to answer for, and is described on the privacy page. This section is the contract Article 28 of the GDPR requires between the two of us.

• What and for how long: running workflows and agents on whatever your company’s systems send them — typically names, contact details and messages of your customers, leads and staff — for as long as your company uses the service.
• Only on your instructions: these terms and what your company configures in the service are your instructions. We process the data for nothing else, unless EU or Slovenian law requires it, in which case we tell you first where the law allows. If an instruction seems to break data protection law, we tell you.
• Confidentiality: everybody at NeoProject who can reach the data is bound to keep it confidential.
• Security: we take the measures Article 32 requires, among them encryption in transit, stored credentials encrypted at rest, separation between companies, an audit trail of changes, two-factor sign-in and nightly backups.
• Sub-processors: your company authorises the ones listed on the privacy page. We tell your admins at least 30 days before adding or replacing one; if you object and we cannot resolve it, you may end the contract. We bind each to the same data protection obligations as these terms, and remain responsible to you for them. Services your company connects with its own accounts are its own providers, not our sub-processors.
• Outside the EU: data goes to a country outside the EU only with a safeguard Chapter V of the GDPR recognises, such as an adequacy decision or the Standard Contractual Clauses.
• Helping you: we help your company answer requests from the people the data is about, and with impact assessments and consulting a supervisory authority, as far as we reasonably can.
• Breaches: if personal data we process for you is breached, we tell your company without undue delay after we become aware, with what you need for your own notification.
• At the end: at your choice, we return the data in a machine-readable form or delete it, unless the law requires us to keep it. Backups roll off within seven nights.
• Audits: we give you the information needed to show we keep to this section, and allow an audit by an auditor you appoint who is bound to confidentiality — on 30 days’ notice, at your cost, at most once a year unless a breach or a supervisory authority calls for another.

Each of us keeps the other’s non-public information confidential and uses it only for this contract. That does not cover information that is public, was already known, was developed independently, or has to be disclosed by law.

The software, the service, its documentation and its brand are ours. Your company gets a non-exclusive, non-transferable right to use the service for its own business while this contract runs. If you send us suggestions, we may use them freely.

We may suspend a company or a person, in whole or in part, to stop a security threat, after a serious breach of these terms, when fees owed to us are still unpaid 30 days after a reminder, or when the law requires it. We warn you first unless the situation does not allow it, and lift the suspension once the cause is gone. Suspending deletes nothing.

The contract runs for as long as your order says. Without one, either of us may end it with 30 days’ written notice. Either of us may end it at once if the other breaches it seriously and does not put it right within 30 days of being told. When it ends, access stops and your data is returned or deleted as described above. What by its nature should outlast the contract — confidentiality, liability, what is owed — does.

We provide the service with reasonable skill and care. Beyond that, and as far as the law allows, it is provided as it is, without a promise that it will be uninterrupted, free of errors or fit for a particular purpose.

Neither of us is liable for lost profit, lost revenue or indirect damage. Our total liability in any twelve months is limited to the fees paid for the service in the twelve months before the event, or 1,000 euros if none were paid.

None of these limits applies to damage caused intentionally or through gross negligence, to injury to life or health, or where the law does not allow liability to be limited. Your company indemnifies us against claims by third parties that arise from the data it puts through the service or from use the terms above do not allow.

We tell your company’s admins by email at least 30 days before a material change takes effect. If your company does not accept it, it may end the contract before then; using the service afterwards accepts it. A change the law requires may apply sooner.

Slovenian law governs this contract, without the UN Convention on Contracts for the International Sale of Goods. The courts in Ljubljana decide any dispute. Neither of us may transfer the contract without the other’s consent, except to whoever takes over the business. Neither is liable for a delay caused by events beyond its reasonable control. If one clause is invalid, the rest stands.

Notices to us go to info-victor@neoproject.ai; notices to your company go to its admins’ email addresses.