Terms of Service

1.1 "Services" means the agentic AI / workflow automation software platform and any hosted APIs, connectors, AI models, tools or modules that we provide, including documentation, updates and integrations.

1.2 "Order Form" means the subscription, purchase or statement of work executed between the parties that references this TOS and defines pricing, scope and term.

1.3 "Customer Data" means data, inputs, text, code, content, workflows, prompts, files and outputs submitted, processed or generated by you or your Authorized Users in connection with the Services.

1.4 "Personal Data" means any information relating to an identified or identifiable natural person (as defined under Applicable Privacy Laws).

1.5 "Sensitive Personal Data" means Personal Data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, health, sexual orientation, genetic or biometric data, or any category considered "sensitive" under Applicable Privacy Laws.

1.6 "Applicable Privacy Laws" includes the EU GDPR, UK GDPR, Singapore PDPA, Japan APPI, Malaysia PDPA, Indonesia PDP Law, China PIPL, US state privacy laws, Africa and Middle East data-protection laws, and any other applicable regime.

1.7 "Authorized Users" means your employees, contractors or agents authorized to access the Services under your account.

1.8 "Sub-processor" means any third party engaged by us to process Customer Data.

1.9 "SLA" means the Service Level Agreement that may be separately executed upon order request.

2.1 Subscription Options. The Services may be provided under the following pricing models:

• SaaS Recurring Fee: a fixed monthly or annual subscription.
• Usage-Based / Credit-Based: a prepaid balance of credits or usage units, consumed as you run workflows, which may be topped up at any time.
• Professional Services: one-time or milestone-based fees for implementation, consulting or custom development.

2.2 Refunds. Except as required by law, all prepaid subscriptions and credits are non-refundable. Unused credits expire twelve (12) months from purchase unless otherwise stated in the Order Form.

2.3 SLA. Availability, uptime and support commitments will be defined in a separate SLA executed upon request.

3.1 We grant you a non-exclusive, non-transferable, limited right to access and use the Services for your internal business purposes.

3.2 You shall not:

• reverse engineer, decompile or modify the Services;
• use the Services to develop competing offerings;
• use the Services for unlawful purposes or process data without lawful basis or consent;
• circumvent security mechanisms or usage limits;
• resell, lease or sublicense the Services without written authorization.

4.1 The Services may integrate with third-party software, APIs or data connectors ("Third-Party Integrations").

4.2 Your use of Third-Party Integrations is subject to those providers' terms and privacy policies. dFlo.ai is not responsible for their acts or omissions.

4.3 By enabling a Third-Party Integration, you authorize us to exchange relevant data (including Personal Data) with that service solely to enable functionality.

4.4 We disclaim liability for failures or breaches originating from systems not under our control.

5.1 Roles. You are the Data Controller and we are the Data Processor under Applicable Privacy Laws.

5.2 Purpose. We process Personal Data only to deliver and improve the Services in accordance with your documented instructions.

5.3 Sensitive Personal Data. Where such data is processed, you represent that you have obtained explicit consent from data subjects. We shall apply heightened safeguards (encryption, restricted access, logging, pseudonymization) and process it only per lawful instructions or consent.

5.4 International Transfers. We may transfer data globally subject to lawful mechanisms (e.g., SCCs, BCRs, adequacy decisions or consent).

5.5 Security. We implement technical and organizational measures consistent with ISO 27001 to protect data against unauthorized access, loss or alteration.

5.6 Data Retention. Upon termination, Customer Data is retained for thirty (30) days for retrieval, then securely deleted or anonymized unless law requires longer retention.

5.7 Data Subject Rights. We assist you to respond to requests for access, correction, erasure, restriction or portability.

5.8 Breach Notification. We will notify you without undue delay (and within statutory deadlines) of any Personal Data breach and supply information needed for your compliance.

5.9 Audit Rights. We may provide independent audit reports or certifications (SOC 2, ISO 27001) upon request.

5.10 Good-Faith Compliance. For jurisdictions with developing privacy laws, both parties shall act on a good-faith basis to meet local requirements.

6.1 Each party must comply with all applicable export-control and sanctions laws, including Singapore law, U.S. EAR, UK and EU regulations.

6.2 You shall not use the Services in any country or by any person subject to comprehensive sanctions or restricted lists.

6.3 You represent that neither you nor your users are prohibited parties and will notify us of any change in status.

9.1 The Term is as stated in the Order Form. Either party may terminate for material breach uncured after 30 days' notice or immediately for insolvency.

9.2 Upon termination, access ceases; fees accrued remain due; data is retained 30 days then deleted (§5.6).

9.3 Sections 4–16 survive termination.

11.1 Each party warrants authority to enter this TOS and compliance with law.

11.2 Except as expressly stated, the Services are provided "as is" without warranties of merchantability, fitness for purpose or non-infringement.

11.3 AI outputs are probabilistic; you must verify their accuracy and suitability before reliance.

12.1 Cap. Our aggregate liability shall not exceed the greater of (i) fees paid in the preceding 12 months or (ii) USD 100,000.

12.2 Exclusions. We shall not be liable for indirect, incidental or consequential loss, loss of profits or data, or business interruption.

12.3 Unintended Use. We accept no liability for harm caused by use of the Services in medical, military, safety-critical or autonomous contexts without human validation.

12.4 Indemnity. Each party indemnifies the other for third-party claims arising from its breach, data misuse or IP infringement of its own deliverables.

16.1 Assignment. Neither party may assign without consent except to affiliates or successors.

16.2 Force Majeure. Neither party is liable for delays caused by events beyond control.

16.3 Notices. Notices must be in writing to the contact in the Order Form and are effective on receipt.

16.4 Severability. Invalid clauses are deemed modified to lawful extent; the rest remain in force.

16.5 Entire Agreement. This TOS plus Order Forms and SLA constitute the entire agreement and supersede all prior understandings.

16.6 Independent Contractors. The parties are independent and not partners or agents.

16.7 Waiver. Failure to enforce a term is not a waiver of future enforcement.