Terms of Service

These Customer Terms of Service (the "Terms") are a contract between Thoth AZ Solutions S.R.L., a Romanian limited liability company with registered office at Str. Piața Falezei nr. 6, demisol, camera 2, 800077 Galați, Romania, registered with the Trade Register under no. J17/936/2022, tax identification code (CUI) 46249620, share capital 200 lei ("SENA", "we", "us"), and the business that creates a SENA workspace or is named on an Order Form ("Customer", "you"). The person accepting these Terms confirms that they are authorised to bind the Customer.

1. Definitions and order of precedence

1.1 In these Terms:

• "Service" means the SENA hosted business platform described in §2, including its modules, AI features, Connected Systems framework and the Apps when used to access it.
• "App" means the SENA software for iOS, Android, macOS or Windows, licensed under the End User Licence Agreement at sena.systems/eula (the "EULA").
• "Organisation" means the Customer's workspace in the Service (also called a workspace in the interface). The two words mean the same thing.
• "Users" means the individuals the Customer authorises to use its Organisation.
• "Order Form" means a written order for the Service signed or electronically accepted by both parties or, absent one, the plan, term and price the Customer selected at checkout as recorded by our payment provider.
• "Customer Data" means all data, documents, messages, records and other content that the Customer or its Users upload to, enter into, or connect to the Organisation, including the names, email addresses, roles and activity of Users within the Organisation, and the AI Outputs derived from that content.
• "Account Data" means data we process as an independent controller for our own purposes: the identity of the contracting entity, the contact and billing details of Organisation admins and billing contacts, invoices and payment records, authentication security and fraud logs, usage metering, and our own communications. Account Data is described in the Privacy Policy (sena.systems/privacy).
• "AI Outputs" has the meaning in §9.2.
• "Connected Systems" means third-party systems the Customer or its Users connect to the Organisation under §7.
• "DPA" means the Data Processing Agreement at sena.systems/dpa.
• "Documentation" means the user documentation we make available at sena.systems/docs or within the Service, as current at the time of use. Marketing materials, sales presentations, demonstrations, the AI Transparency Notice, roadmap statements and answers to questionnaires are not Documentation unless attached to a signed Order Form.
• "Agreement" means these Terms, the DPA, any Order Form, and the Annexes.

1.2 The following are part of the Agreement: the DPA; the Acceptable Use Policy (Annex A); the Service Levels (Annex B); and, where selected in an Order Form, the Regulated Customer Addendum. The AI Transparency Notice at sena.systems/ai is provided for information under Regulation (EU) 2024/1689 and is not part of the Agreement; the contractual terms for AI features are §9 and Annex A.

1.3 In case of conflict, the following order applies: (1) an Order Form signed or electronically accepted by both parties, except that an Order Form cannot reduce the protections that GDPR art. 28 requires in the DPA; (2) the DPA, as regards personal data; (3) the Regulated Customer Addendum, where selected; (4) these Terms; (5) the Annexes; (6) policies and Documentation.

2. The Service

2.1 The Service is a multi-tenant, browser-based business platform that ingests a business's data (documents you upload, systems you connect, information you enter), maintains an organisational memory of it, produces briefings, research and analyses using AI models, and lets your Users prepare and, with human approval, execute actions in the platform's modules. Modules include, depending on plan and configuration: Home and Dashboard, Assistant (chat), Documents (knowledge base with cited retrieval), Activity (scheduled "beats", pipelines and drafts), Projects and Tasks, CRM, Sales, Marketing, Employees, Payroll, Accounting, Inventory, Production, Suppliers, Assets, Properties, Front Desk, Restaurant, Investments, Analytics and Forecasts, Legal and Compliance, Calendar and Mail mirrors, and Integrations.

2.2 The Service is provided from infrastructure located in the European Union, except that the identity, payment, email-delivery, network-egress and, for the Apps, push-notification providers named in the sub-processor list at sena.systems/subprocessors process limited data as described there and in the DPA §12.

2.3 We may update, add or retire features. We will not materially reduce the core functionality of a paid plan during a paid term without a proportionate remedy (credit or a termination right with refund under §12.6). Features marked "beta", "alpha" or "preview" (including most Connected Systems at launch) are provided as-is, may change or be withdrawn without notice, and are excluded from Annex B.

3. Eligibility, accounts and authority

3.1 Business use only. The Service is offered to businesses, public bodies and professionals acting in the course of their trade. It is not offered to consumers. By signing up you represent that you act for a business, that you are at least 18 years old, and you will provide your company registration and VAT identifiers at signup. We may close, without refund of fees accrued, any account that we reasonably determine is used for non-business purposes.

3.2 Signatory. If the person accepting these Terms is not authorised to bind the Customer, that person is personally liable to us for the fees and obligations under them (Civil Code art. 1310).

3.3 Accounts. You create an Organisation and invite Users. Each User needs an individual account; sharing credentials is prohibited. Authentication is provided through our identity provider; you must keep credentials confidential and notify us without delay at security@sena.systems of any suspected unauthorised access.

3.4 Admins. The admin(s) of your Organisation control which modules are enabled, which Users have which roles, which Connected Systems are linked, and can request data export or closure of the Organisation. You are responsible for the acts and omissions of your Users.

3.5 Authority of accounts. We may rely on any instruction, approval or connection made through an authenticated account, API key or OAuth grant belonging to your Organisation as authorised by you, until you disable it or notify us at security@sena.systems. You will remove access for Users who leave, keep roles current, and are responsible for actions taken through accounts you have not disabled. You warrant that every Connected System account is one your User is entitled to connect for your business purposes.

4. Plans, fees and payment

4.1 Plans. Plans are priced per Organisation, flat per month, with all modules and unlimited Users included, plus an included monthly allowance of AI work measured in credits. Current plans, prices, included credits and fair-use limits are published at sena.systems/pricing and shown in Settings → Subscription. The pricing page at the time of your order (or your Order Form) sets the price you pay until changed under §4.7.

4.2 Credits and overage. AI work (assistant turns, scheduled beats, research, document processing) consumes credits according to the methodology shown in Settings → Usage. Unused included credits expire at the end of each monthly period and do not roll over. When the included allowance is used up, AI features pause until the next period begins or you move to a plan with a larger allowance; we do not bill overage and do not sell top-ups. Daily fair-use caps apply during trials.

4.3 Billing and payment mandate. Subscriptions are billed in advance, monthly or annually as selected, through our payment provider, Stripe Payments Europe Ltd ("Stripe"). By providing a payment method you authorise us and Stripe to store it and to charge it for each renewal without further action by you, until you cancel; your bank may require you to authenticate the first payment. Stripe processes your payment data as an independent controller under its privacy policy (stripe.com/privacy). Card details are held by Stripe only; we never see or store full card numbers. Invoices are issued in EUR; VAT is charged where the law requires it. Romanian customers also receive the invoice through the RO e-Factura system as the law requires.

4.4 Payment terms. Card and direct-debit charges are taken on the invoice date. Where we agree invoice payment, invoices are due within 14 days of issue.

4.5 Late payment. If a charge fails, we will retry and notify you. If payment is not received within 14 days of the due date we may suspend the Service under §11 until paid. Late-payment interest accrues from the day after the due date without formal notice, at the penalty rate in OG 13/2011 art. 3(2^1) (the BNR reference rate plus 8 percentage points), together with the fixed recovery cost of the RON equivalent of EUR 40 and any further reasonable recovery costs, under Law 72/2013 arts. 3 and 10.

4.6 Taxes and withholding. Fees exclude taxes. You are responsible for any taxes other than taxes on our income. If you are required to withhold tax from a payment, you will gross up so that we receive the invoiced amount and provide the withholding certificate.

4.7 Price changes. We may change prices with at least 30 days' notice by email to Organisation admins and in-app. Changes take effect at your next renewal after the notice period. Annual prepaid terms are not affected until they renew. If you do not accept a change, you may cancel under §12.2 before it takes effect.

4.8 Prepaid offers. Where you prepay a term at a discount, the prepaid fees are non-refundable except as stated in §12.6, §14 or §17.

4.9 Changes of plan. You may upgrade at any time; the price difference for the remainder of the current period is charged pro rata and the new allowance applies immediately. Downgrades take effect at the next renewal; no refund is made for the current period.

4.10 Currency. Fees are denominated and payable in EUR. Where the law requires, VAT amounts are also shown in RON at the BNR rate of the invoice date. Bank, card and currency conversion charges are for your account.

4.11 Disputes and chargebacks. Raise billing disputes with us at support@sena.systems within 30 days of the invoice date. A payment reversal or chargeback initiated without first raising the dispute with us is a payment failure under §4.5; we may suspend the Service until the dispute is resolved and recover the dispute fee where the charge was valid.

4.12 Fair use. Plans include storage, Connected System sync volumes and API request rates as published on the pricing page; we may throttle use beyond them and offer an upgrade.

4.13 Credit methodology. We may change how credits are computed with 30 days' notice. A change that reduces the effective included allowance of your plan by more than 10% during a prepaid term entitles you to a proportionate increase in credits or to terminate with a refund under §12.6.

5. Free trial

5.1 New Organisations receive a free trial of 3 days, with no payment method required. During the trial all modules are enabled, subject to fair-use caps on AI work.

5.2 At the end of the trial, paid features lock. Your data remains readable and exportable for 30 days, during which you may subscribe at any time. If you do not subscribe within those 30 days, the Organisation is closed under §6.7.

5.3 Trials are one per Organisation. We may withdraw or shorten trials for abuse.

6. Customer Data

6.1 Ownership. As between you and us, you own Customer Data. We claim no rights in it other than the licence in §6.2. AI Outputs are addressed in §10.3.

6.2 Licence to us; no training. You grant us a non-exclusive, worldwide licence to host, process, transmit, index, embed, analyse and display Customer Data solely to provide, secure and support the Service for you, in accordance with the Agreement. We do not use Customer Data to train, fine-tune or evaluate AI models or prompts for use by other customers, and we do not build datasets from it. We contractually require our AI inference providers not to store, log or train on it beyond transient processing. Any quality evaluation using Customer Data is run within your Organisation, on your data only, and its results are not kept outside your Organisation except in aggregated, non-identifying form. Data received from Google or Microsoft APIs is used only as stated in §7.3 and §7.4, which prevail over this clause.

6.3 Personnel access. Our staff may access Customer Data only (a) to provide support you request, (b) to investigate a security incident, abuse, or a failure affecting your Organisation, (c) as required by law, or (d) as you otherwise instruct in writing. Each such access is limited to the minimum needed, uses personal credentials, and is logged. For debugging, the Service keeps prompt and response traces of AI interactions for up to 30 days in our own infrastructure; only named engineers can read them, for the purposes above.

6.4 Personal data. Where Customer Data contains personal data, you are the controller (or, where you act for your own clients, a processor, in which case the DPA §2.2 applies) and we are your processor. The DPA governs. You are responsible for having a lawful basis and for the notices to your data subjects, including to your employees under §8.4.

6.5 Account Data and usage data. We process Account Data as described in the Privacy Policy. We collect data about how the Service is used (feature usage, performance, error diagnostics, AI work consumption) to operate, secure, bill and improve the Service, and may use it in aggregated, non-identifying form. Product analytics that follow an individual User's path through the Service run only for Users who opt in, under a user number rather than their name (Privacy Policy, Cookie Policy).

6.6 Export. At any time during the term, the account owner (the User recorded as the owner of your SENA account) may download an export bundle from Settings → Privacy → Data export. The bundle contains your Organisation's records, employee records, document index and organisational memory in machine-readable form. A complete export of every Organisation-scoped table and of your uploaded files is available on written request to privacy@sena.systems, delivered within 10 business days, during the term and for 30 days after closure. We will assist with further export requests at our then-current professional-services rates.

6.7 Deletion and restoration. When an Organisation is closed, or a User account is deleted, access ends immediately. The data is kept for a 30-day grace period during which an Organisation admin may request restoration in writing, at no charge, once per Organisation. After the grace period the data is permanently deleted from production systems; encrypted backup copies age out within 30 days after that. Restoration after the grace period is not possible. Backups exist for disaster recovery of the platform, are restored as a whole, are not a per-record restore service, and are not a substitute for your own exports. We retain our own records of the relationship (invoices, contract acceptance records, security logs) for the periods in the Privacy Policy.

6.8 Security. We maintain the technical and organisational measures described in Annex II of the DPA, including tenant isolation enforced at the database level, encryption in transit and at rest, encrypted storage of connection credentials, role-based access, immutable audit logging and periodic security reviews. We operate an information security management system aligned with ISO/IEC 27001; certification by TÜV Austria Romania is in progress and has not yet been obtained. We may replace individual measures with measures of equivalent or better effect.

6.9 Confidentiality incidents. We will notify you without undue delay, and within 72 hours of confirming it, of any unauthorised access to or loss of Customer Data that is not a personal data breach under the DPA, with the information reasonably available. Personal data breaches are notified under the DPA §8.

7. Connected Systems

7.1 Connecting. You may connect third-party systems (for example Google Drive, Microsoft OneDrive and SharePoint, Google or Microsoft calendars, IMAP, Microsoft 365 or, where enabled, Gmail mailboxes, Linear, Snowflake, Personio, ANAF e-Factura, Meta WhatsApp Business). Connecting a system authorises SENA to read, and where the connector supports it and you approve it under §9.3, write data on your behalf within the scope you grant. The Documentation states, per connector, what is read, what can be written, and what is beta.

7.2 Third-party terms; authority. Each connection is subject to the third party's own terms and privacy policy. You are responsible for having the right to connect the account and for the data the connection brings into the Service; you will indemnify us under §14.6 for claims by an account holder or provider arising from a connection made without that right. We may suspend a connection that the third party revokes, that violates the third party's terms, or that creates a security risk. Your provider may send change notifications (webhooks) to SENA so the connection stays current.

7.3 Google user data. SENA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google-derived data is used only to provide or improve the user-facing SENA features the connecting User enabled, is never sold or used for advertising, is never used to develop, improve or train generalised AI or machine-learning models, is transferred only to the sub-processors needed to provide those features, and is not read by SENA staff unless the connecting User has given affirmative agreement to us viewing specific files or messages, or reading is necessary to investigate abuse or security incidents, or the law requires it. The Privacy Policy §9A describes what is accessed, stored, shared and deleted.

7.4 Microsoft data. SENA's use of data obtained through Microsoft Graph complies with the Microsoft APIs Terms of Use, and §7.3 applies to Microsoft-derived data as it does to Google-derived data. Your Microsoft 365 administrator may need to grant consent for all Users; SharePoint document libraries the connecting User can access fall within the granted scope, and you should restrict the indexed scope in Settings → Integrations.

7.5 Mailbox and calendar mirrors. Mirrors are per User: message bodies and event details are visible only to the User who connected the account; other Users and the shared CRM see bounded metadata only (sender, recipient, date, subject, linkage to a contact), which is retained for 30 days by default and longer only where you have documented a justification under §8.4. Mirrors are read-only unless you enable a sending or writing feature for a connection, in which case each send or write requires approval under §9.3; today SENA sends no email and modifies no calendar. Message bodies are kept while the mailbox stays connected and are deleted when the User disconnects it or is removed. The per-User visibility of mirrored content is a configuration you accept as your instruction under the DPA: admins cannot read mirrored bodies. When a User is removed or disconnects, the mirrored bodies and event details are deleted within the grace period in §6.7 and the bounded metadata already linked to CRM records remains for its retention period; if you need the underlying messages, obtain them from the mail system you administer, which remains the system of record.

7.6 ANAF e-Factura. SENA registers its application with ANAF's authorisation service and, on your approval, transmits the invoices you issue in the Accounting module as UBL 2.1 / CIUS-RO XML to the RO e-Factura system, then downloads ANAF's response (the sealed XML and the Ministry of Finance signature file, which together are your legal original) and makes it available in the module. The connection is made by a natural person registered in ANAF's Virtual Private Space (SPV) as legal representative or authorised person for your company, using their qualified certificate; the token expires at the end of ANAF's validity period, when the certificate expires or when that person's rights are withdrawn, and must then be renewed. You can revoke SENA's access at any time in SPV or in Settings → Integrations. You remain the issuer of every invoice and are responsible for its content, its fiscal correctness, the legal transmission deadlines and for archiving the sealed originals for the statutory retention period. SENA keeps the sealed responses in your Organisation during the term and includes them in every export; you are the archive holder and must export them before closing your Organisation, since §6.7 applies. SENA is not an electronic archive provider and does not act on your behalf before ANAF beyond the transmissions you approve. SENA is not liable for fines, interest or other consequences of a rejected, late or failed transmission, of RO e-Factura or SPV unavailability, or of an expired, revoked or insufficient certificate. Transmission status is shown in the module and you must check it before the legal deadline.

7.7 WhatsApp Business. You connect your own WhatsApp Business Account under Meta's WhatsApp Business Terms and Business Messaging Policy, which you must follow, including collecting and keeping proof of opt-in before sending business-initiated messages. SENA receives the messages your customers send to your number and stores them in your Organisation as Customer Data. SENA does not send WhatsApp messages. If a reply feature ships, every message will be sent only on your approval under §9.3 and within Meta's rules, and where a reply is generated by AI you must make that clear to the recipient. SENA uses WhatsApp data only to provide your Organisation's features, never to train models and never for its own purposes.

7.8 Beta connectors are excluded from Service Levels and may be changed or withdrawn.

8. Your obligations

8.1 You will use the Service only for lawful business purposes and in line with the Acceptable Use Policy (Annex A).

8.2 Special categories. You will not upload data you have no right to process, and you will not deliberately use the Service to process special categories of personal data (GDPR art. 9) or criminal-offence data (art. 10) except where the law requires you to hold them for your own employees (for example medical-leave records in Payroll). Documents, mailboxes and Connected Systems may incidentally contain such data; the DPA §3.4 allocates responsibility for it. SENA is not designed as a patient, medical or clinical record system and must not be used as one.

8.3 You are responsible for reviewing AI Outputs (defined in §9.2) before relying on or acting on them.

8.4 Employees. Before connecting employee mailboxes, calendars, HR systems or entering employee data you will: (a) inform the employees concerned as required by GDPR art. 13, Law 190/2018 and applicable labour law; (b) consult and, where required, obtain the agreement of the trade union, employee representatives or works council; (c) document your legitimate interest and, where Law 190/2018 art. 5 or an equivalent national rule applies, set the retention windows for CRM-visible metadata and individual attendance detail so that they do not exceed what that rule permits (30 days unless you have a documented justification); and (d) ensure that connections to an individual's mailbox or calendar are made by that individual, and connections to shared mailboxes by an admin with documented authority. Default windows are listed in the Documentation and are not a statement that they are lawful for your use.

8.5 You will keep your billing and contact details current and designate at least one Organisation admin.

9. AI features: what they are and what they are not

9.1 The Service uses large language models and other machine-learning systems supplied by third-party inference providers located in the EU (named at sena.systems/subprocessors) to generate text, summaries, briefings, research, classifications, forecasts and draft actions.

9.2 AI Outputs. "AI Outputs" means content generated by those systems. AI Outputs are generated automatically, can be incomplete, inaccurate, out of date or wrong, and may reflect limitations or biases of the underlying models or of your data. AI Outputs are labelled as AI-generated where the interface presents them; labels may not persist when content is copied, exported or forwarded, and you are responsible for any labelling required when you distribute it. You must review AI Outputs with human judgement before acting on them. We do not warrant the accuracy, completeness or fitness of any AI Output.

9.3 Human approval. Any action that the Service proposes which creates or changes business records in your modules, sends an e-invoice, dispatches a message, or writes to a Connected System is executed only after approval in the interface by a User whose role permits it, and the approval is recorded. Ingestion, indexing, mirroring, contact linkage, memory entries and briefings run automatically because you switched them on; you can edit or delete their results. You are responsible for every approved action as if you had performed it yourself. If an action is executed without the required approval because of a defect, you will notify us within 5 business days of becoming aware, we will correct the record where the Connected System allows it, and our liability is subject to §14.

9.4 No automated decisions with legal effect. The Service does not make decisions producing legal or similarly significant effects on individuals without human involvement. You must not configure or use the Service to do so (for example automatic hiring, dismissal, credit or benefit decisions).

9.5 Not professional advice. The Legal, Compliance, Accounting, Payroll, Investments and Forecasts modules provide general information, computations and analysis to support your own decisions and those of your professional advisers. They do not provide legal consultancy, representation, accounting, tax, audit, financial or investment advice, they do not apply the law to your particular situation with the judgement of a qualified professional, and using them creates no professional-client relationship and no privilege. Activities reserved by law to lawyers (Law 51/1995), accountants (OG 65/1994), tax consultants (OG 71/2001) or other regulated professions remain your responsibility to obtain from a qualified person; outputs of these modules must be verified by such a person before you rely on them or file them with any authority. Where the Legal module cites Romanian legislation it is designed to reproduce the text of the cited provision and to report when a question is not covered by its corpus rather than guess. This describes a design goal, not a warranty: citations can be wrong, outdated, repealed or incomplete, and you must verify every citation against the official source before relying on it.

9.6 Web research. Research features retrieve publicly available web content through search infrastructure we operate, the public search engines it queries and the network providers listed at sena.systems/subprocessors, and summarise it with citations. Retrieved content belongs to its publishers and is provided to you for internal analysis only; you will not redistribute it, and you are responsible for your use of it. Where you ask the Service to research a named individual, you are the controller of that processing and responsible for a lawful basis and for the information duties of GDPR art. 14; you will not use research features to profile individuals for purposes prohibited by §9.4 or Annex A.

9.7 Adversarial content. Documents, emails and web pages you bring into the Service may contain text designed to manipulate AI systems. We apply technical defences, but you accept that no defence is complete and that the review and approval steps in §9.2 and §9.3 are the primary safeguard.

9.8 Models and providers. We select and may change the AI models and inference providers used by the Service, including replacing a model with one of equivalent or better quality, without notice, provided that Customer Data continues to be processed in the EU under the DPA and any new sub-processor is notified under the DPA §6. Some models are supplied under third-party licences whose use restrictions are summarised at sena.systems/ai; you will not use the Service in a way that breaches them, and we may block requests that would.

9.9 High-risk use. The Service is not designed for, and you will not use it in, contexts where a failure could lead to death, personal injury, or severe environmental or property damage, for medical, clinical or safety-of-life purposes, or for any use listed in Annex III of Regulation (EU) 2024/1689 (including the employment uses in its point 4) without a written agreement with us that allocates the corresponding obligations.

10. Intellectual property

10.1 The Service, its software, methods of operation, prompts, interfaces, Documentation and all improvements are owned by SENA or its licensors and are licensed, not sold. Subject to the Agreement you receive a non-exclusive, non-transferable right to access and use the Service for your internal business during the term.

10.2 You will not copy, modify, reverse-engineer, scrape, benchmark for publication without consent, resell, sublicense, or build a competing product from the Service, nor remove any notices.

10.3 AI Outputs. As between you and us, you may use AI Outputs generated for you for any lawful purpose, during and after the term. We claim no ownership of AI Outputs. To the extent any intellectual property right of ours or our licensors subsists in an AI Output (excluding our templates, system prompts, interface elements and Documentation reproduced in it), we grant you a perpetual, irrevocable, worldwide, royalty-free licence to use, copy, modify and distribute it. You accept that AI Outputs may not be protected by copyright, that similar outputs may be generated for other customers from their own data, and that we do not guarantee uniqueness or non-infringement.

10.4 Feedback you give us may be used freely without obligation.

10.5 Publicity. We will not name you as a customer without your written consent. You will not represent that we endorse you.

11. Suspension

11.1 We may suspend all or part of the Service, with notice where practicable, if: (a) fees are more than 14 days overdue; (b) your use breaches Annex A or threatens the security, integrity or availability of the Service or other customers; (c) a third party or authority requires it; (d) a Connected System is being abused. We will limit the suspension to what is necessary and restore service promptly once the cause is resolved. Fees continue to accrue during suspensions caused by you.

12. Term and termination

12.1 The Agreement starts when you accept these Terms and continues for the plan period (monthly or annual), renewing automatically for successive periods until cancelled.

12.2 Cancellation by you. You may cancel at any time in Settings → Subscription. Cancellation takes effect at the end of the current paid period; you keep access until then. No refund is due for the remainder of a paid period except under §12.6, §14, §17 or the DPA §6.2.

12.3 Termination for cause. Either party may terminate immediately by written notice if the other materially breaches the Agreement and fails to cure within 15 days of notice, or ceases business.

12.4 Termination by us for convenience. We may terminate the Agreement for convenience on at least 90 days' notice, effective at the end of a billing period, and we may withdraw the Service from the market on at least 180 days' notice; in both cases we refund prepaid fees for the unused period under §12.6.

12.5 Insolvency. If insolvency proceedings are opened against you under Law 85/2014, we will exercise our rights under its art. 123 (including asking the judicial administrator to confirm continuation within 30 days and requiring payment of fees accruing after the opening as they fall due), and we may suspend under §11 for non-payment of fees accruing after the opening of proceedings; where another insolvency law applies, we may terminate to the extent that law permits.

12.6 Refund on our default. If we terminate for convenience, materially reduce the Service under §2.3, change the credit methodology under §4.13 beyond the stated threshold, or you terminate for our uncured material breach, we refund prepaid fees for the unused period.

12.7 Effect and survival. On termination: your right to use the Service ends; export remains available for 30 days under §6.6; data is deleted under §6.7. Sections 4 (for amounts accrued), 6.6, 6.7, 9.5, 10, 13, 14, 18 and the DPA §10 survive termination.

13. Confidentiality

13.1 Each party will keep the other's non-public information confidential, use it only for the Agreement, and protect it with reasonable care, for the term and 5 years after, and for Customer Data and trade secrets (Law 62/2019) for as long as they remain confidential. Customer Data is your confidential information. Exceptions: information that is public without breach, already known, independently developed, or required to be disclosed by law (with notice where allowed).

14. Warranties and liability

14.1 We warrant that the Service will perform materially as described in the Documentation and that we will provide it with reasonable skill and care. Your sole remedy for breach of this warranty is that we fix the non-conformity or, if we cannot within a reasonable time, you may terminate and receive a refund under §12.6.

14.2 Except as expressly stated, the Service, Connected Systems and AI Outputs are provided "as is". We disclaim all other warranties, including fitness for a particular purpose, uninterrupted or error-free operation, and the accuracy of AI Outputs. Statements about third-party providers reflect their contractual commitments to us and are not warranties of those providers' internal operation.

14.3 Excluded losses; data. Neither party is liable for indirect or consequential loss, loss of profit, revenue, business, goodwill or anticipated savings. Our liability for loss or corruption of Customer Data is limited to restoring it from the most recent available backup at our cost. We are not liable for loss of data that you could have exported or backed up with the tools the Service offers and did not, or for data held only in beta features or in a Connected System.

14.4 Cap. Each party's total aggregate liability under or in connection with the Agreement, the EULA and any Order Form, whether in contract, tort (including negligence), statute or otherwise, for all claims arising in a contract year is limited to the total fees paid and payable by you for the 12 months preceding the first event giving rise to liability in that year or, where the Agreement has run for less than 12 months, twelve times the average monthly fee paid to date. For our breach of §6.8 or of the DPA that results in a personal data breach, the limit is two times that amount. These limits are aggregate for all claims by you, your affiliates and your Users, and a payment under one head reduces the amount available under the other.

14.5 Carve-outs. Nothing limits liability for death or personal injury caused by negligence, for fraud, for intent or gross negligence (Civil Code art. 1355), for your payment obligations, for your breach of §10.2 or Annex A, for your indemnity under §14.6, for your liability arising from a breach of §3, §7, §8, §9.4 or §15, for fines, penalties or sanctions imposed on a party by a public authority as a result of the other party's breach, or for anything that cannot be limited by law.

14.6 Your indemnity. You will defend, indemnify and hold us harmless against all third-party claims, proceedings, fines, penalties, losses and costs (including reasonable legal fees) arising from: Customer Data, including data you had no right to process or upload; your Connected Systems and the accounts used to connect them; your use of or reliance on AI Outputs; any action approved under §9.3; or your breach of §8, §9.4, §15 or Annex A; except to the extent caused by our breach of the Agreement. We will notify you promptly, let you control the defence, and not settle without your consent.

14.7 Our indemnity. We will defend and indemnify you against third-party claims that the Service as provided by us infringes an EU intellectual property right, provided you notify us promptly and let us control the defence. We may modify or replace the Service or, if neither is reasonably possible, terminate and refund under §12.6. This does not cover Customer Data, Connected Systems, AI Outputs derived from your data, or use in breach of the Agreement.

15. Compliance with law

15.1 Each party complies with laws applicable to it, including data protection (GDPR, Law 190/2018), the EU AI Act (Regulation (EU) 2024/1689) in its role, anti-corruption and export-control laws.

15.2 You will not use the Service in violation of sanctions or export controls, and you represent that you are not a sanctioned person.

16. Support

16.1 Support is provided by email at support@sena.systems and in-app on business days from 09:00 to 18:00 Bucharest time. Security incidents can be reported at any time to security@sena.systems. Response targets by plan are in Annex B.

17. Changes to these Terms

17.1 We may update these Terms. Material changes take effect no earlier than 30 days after notice by email to Organisation admins and in-app. If you object in writing before the effective date you may terminate with a pro-rata refund of any prepaid unused period; otherwise the change applies from the effective date, and any changed clause listed in §18.8 applies only once an admin has given the express acceptance described there, which we will request in-app. Non-material changes (corrections, new feature descriptions, updated legal references, new sub-processors under the DPA) take effect on publication with notice in-app. Changes required by law take effect on the date the law requires. The current version and the change history are at sena.systems/terms/history.

18. General

18.1 Governing law, escalation and courts. Romanian law governs. Before starting proceedings, other than for interim relief or unpaid fees, a party will give written notice of the dispute and the parties' senior managers will meet, in person or by video, within 20 business days to attempt to resolve it in good faith. The courts of Bucharest have exclusive jurisdiction. Customers with an Enterprise Order Form may agree arbitration under the rules of the Court of International Commercial Arbitration attached to the Chamber of Commerce and Industry of Romania, seat Bucharest, language English.

18.2 Notices. Notices under §11, §12, §14 or §17 must be in writing by email: to us at legal@sena.systems; to you at the Organisation admin email addresses on file, with a copy in-app. Email notices are deemed received on the next business day in Bucharest after sending unless a delivery failure is received. Operational notices may be given in-app only.

18.3 Assignment. You may not assign without our consent (not unreasonably withheld); we may assign to an affiliate or a successor in a merger or asset sale with notice.

18.4 Force majeure. Neither party is liable for failure caused by events beyond its reasonable control, excluding payment obligations.

18.5 Entire agreement; non-reliance; severability; waiver; independence. The Agreement is the whole agreement on its subject and supersedes prior communications. You confirm that you have not relied on any statement, presentation, demonstration, questionnaire response or marketing claim not set out in the Agreement or a signed Order Form, and that you have no remedy in respect of any such statement except for fraud. If a clause is unenforceable the rest stands. Failure to enforce is not waiver. The parties are independent contractors.

18.6 Language. These Terms are published in English, which governs. Any translation we publish is for convenience.

18.7 Consumer protection notice. The Service is for business use only. If you are nevertheless a consumer under Romanian law, mandatory consumer rights apply notwithstanding these Terms, and you may contact ANPC (anpc.ro).

18.8 Express acceptance of specific clauses. You confirm that you have read and expressly accept, in writing, the following clauses, which may qualify as unusual standard clauses under Civil Code art. 1203: §4.2 (expiry of unused credits and pausing of AI features), §4.5 and §11 (suspension of the Service), §4.11 (chargebacks), §12.1 (automatic renewal), §12.2 (no refund for the current period), §14.1 (sole remedy for the service warranty), §14.3 (excluded losses), §14.4 (limitation of liability), §14.6 (your indemnity), §17 (changes to these Terms), §18.1 (governing law, jurisdiction and arbitration option), Annex B.2 (service credits as sole remedy and the 30-day claim window) and the DPA §6.2 (sole remedy for sub-processor objections). This acceptance is given in a step separate from your general acceptance of these Terms and is recorded with the version, date, time, the identity of the accepting User and the IP address. The parties agree that this record constitutes acceptance in writing and is admissible evidence of it under Law 455/2001, Regulation (EU) 910/2014 art. 25 and Law 365/2002 art. 7.

Annex A: Acceptable Use Policy

You will not, and will not allow your Users to:

1. Use the Service to break the law, infringe third-party rights, or process data you have no right to process.
2. Upload or connect content that is unlawful, malicious (malware, exploit code), or designed to manipulate the Service's AI systems or extract other customers' data.
3. Probe, scan, penetration-test (without our written consent), overload, or interfere with the Service, its infrastructure, or its tenant boundaries.
4. Use the Service to send unsolicited communications, or to generate content for spam, fraud, harassment, discrimination or disinformation.
5. Use AI features to make automated decisions with legal or similarly significant effects on individuals, to rank, score, monitor or evaluate employees or candidates, to allocate work to individuals based on their behaviour, or for any use listed as prohibited or high-risk in the EU AI Act without our written agreement.
6. Use the Service for patient, clinical or medical records, or for processing special-category data beyond what §8.2 allows.
7. Access the Service by automated means other than the documented API, exceed documented rate limits, or share accounts.
8. Resell, white-label or provide the Service to third parties, or use it to build a competing product.
9. Misrepresent AI Outputs as human-authored where a law or a platform requires disclosure, or remove AI-generated labels from content you distribute where that is required.
10. Use any AI-assisted calling or messaging feature for unsolicited commercial calls or messages, to any person who has not given prior express consent where the law requires it (Law 506/2004 art. 12), or without disclosing at the start that the caller or sender is an AI system.

We may remove content, suspend accounts or connections, and report unlawful activity to authorities. Report abuse to security@sena.systems.

Annex B: Service Levels

B.1 Availability. We target monthly availability of the production Service (login, assistant, documents) of 99.5% for Growth, Scale and Enterprise plans, measured by our monitoring, excluding: scheduled maintenance announced 48 hours in advance (max 8 hours/month, outside 07:00-20:00 Bucharest time where possible), emergency security maintenance, beta features, Connected Systems and third-party providers, and events under §18.4 or caused by you. Starter plans receive commercially reasonable efforts without a percentage commitment.

B.2 Service credits. If monthly availability for a Growth, Scale or Enterprise plan falls below 99.5%, you may request within 30 days a credit of 5% of that month's fee; below 99.0%, 10%; below 95%, 25%. Credits are applied to future invoices, are your sole remedy for availability shortfalls, and cannot exceed 25% of a month's fee.

B.3 Support response targets (business days, Bucharest time):

B.4 Backups. Production databases are backed up at least daily to encrypted storage in a second EU region, with 30-day retention; uploaded files are mirrored nightly to a second EU region with 30-day version retention. Restore procedures are tested at least twice a year. Backups are restored as a whole; individual records are not restored from backup.

B.5 AI processing. AI Outputs depend on third-party inference providers. Targets: assistant first token within 10 seconds for 95% of turns; scheduled beats delivered within their configured window. These are targets, not credited commitments.