These Customer Terms of Service are between Oshyn Inc (“Oshyn”) and the legal entity identified as the customer in the applicable Order (“Customer”). They govern Customer's subscription to and use of ContextCloud. An individual accepting these terms for Customer represents that the individual has authority to bind Customer. If that authority is absent, the individual must not accept on Customer's behalf.
1. Agreement; orders; precedence
1.1 Formation. This agreement takes effect when Customer accepts these terms through an express electronic acceptance or enters into an Order that expressly incorporates them. Together, these terms, the applicable Orders, and the documents expressly incorporated under this section constitute the “Agreement.” A visit to a website or receipt of a shared link does not, by itself, constitute acceptance on behalf of Customer.
1.2 Incorporated documents. The Acceptable Use Policy (“AUP”) forms part of the Agreement. The Beta Terms apply only to a beta or pilot offering that Customer expressly accepts. A data processing addendum (“DPA”) or other negotiated addendum applies when separately executed by the parties. References to a privacy notice, subprocessor register, documentation, or another informational page do not incorporate the entire page as additional contract terms. An express commitment in this Agreement referring to such a page remains binding.
1.3 Signed agreements. A separately signed agreement covering ContextCloud takes priority over these terms on every matter it addresses. These terms supplement that agreement only where it is silent. Accepting these terms or an update through Checkout or the account portal does not amend or replace the signed agreement.
1.4 Other conflicts. Subject to section 1.3 and requirements of applicable law, an executed DPA controls conflicts concerning its data-processing subject matter; accepted Beta Terms control matters specific to the beta offering; and these terms control over the AUP. An Order controls the subscription's scope, price, duration, and other expressly identified commercial terms. An Order changes another provision of these terms only if it identifies that provision and both parties expressly agree to the change. Mandatory protections in an applicable data-transfer instrument cannot be displaced by a conflicting commercial term. Purchase-order boilerplate does not amend the Agreement merely because Oshyn processes an order or accepts payment.
1.5 Initial service scope. Our current marketing and solicitation are limited to Customers in the United States and Canada. This marketing focus does not by itself prohibit registration from elsewhere. Customer must not use the Service for processing that requires European Economic Area, United Kingdom, or Swiss transfer safeguards unless Oshyn has approved that processing in writing and the required safeguards are in place. Customer's location or billing address alone does not determine the privacy laws applicable to its data or use. These restrictions do not excuse either party from mandatory applicable law.
2. Definitions
In addition to terms defined elsewhere:
- Service means the ContextCloud hosted software, associated ContextCloud applications, and account portal made available under an Order. A customer-selected third-party service is not part of the Service merely because it connects to ContextCloud.
- Order means an order form signed by the parties or subscription details presented at Checkout and expressly accepted by Customer, identifying the plan, charges, subscription period, and any applicable usage limits or renewal terms.
- Organization means Customer's tenant within the Service. Tenant separation is logical separation within shared infrastructure, not a commitment to dedicated infrastructure.
- Member means an individual Customer authorizes to join its Organization. Guest means an individual Customer authorizes to access selected Customer Data through the Service's sharing features without making that individual a Member. Authorized Users means Members and Guests, each within their authorized access.
- Customer Data means data and materials submitted to, stored in, or processed through the Service by or for Customer, including conversation content, files, artifacts, instructions, credential records, Organization audit records, and Output. It includes materials in Members' personal spaces. It excludes the Service's underlying software and Oshyn's own subscription, invoicing, and corporate records.
- Input means Customer Data supplied to a model or automated workflow. Output means content generated in response. A Run is an execution of a model or agent workflow; a Run may involve multiple requests and external actions.
- Managed Inference means ContextCloud sends Customer's AI requests using Oshyn's account with a model provider or routing provider. Bring Your Own Key (“BYOK”) means it sends those requests using Customer's own provider account and the credentials Customer supplies. Whether BYOK is available for a given provider, including a routing provider, is stated in the Order.
- Third-Party Service means an outside application, model service, data source, connector destination, or other service Customer elects to connect or use under Customer's own relationship with its provider. A provider engaged by Oshyn to perform Oshyn's obligations is not relieved of its status as Oshyn's subcontractor or subprocessor merely by this definition.
- Documentation means Oshyn's published instructions for the applicable Service, excluding marketing statements and descriptions of unreleased features.
3. Subscription, fees, and Service access
3.1 Access rights. During the applicable subscription and any limited-access period expressly provided below, Oshyn permits Customer and its Authorized Users to access and use the Service for Customer's lawful business purposes within the Order and this Agreement. Customer may use the associated applications as needed for that access. These permissions do not convey ownership of the Service or a right to resell access to it.
3.2 Orders and renewals. Each Order specifies the subscription period and whether and how it renews. Customer authorizes recurring charges only to the extent disclosed in and accepted with the Order. An invoice records charges under the agreed terms; it does not independently change those terms. Customer is not purchasing a commitment to deliver a future feature unless the parties expressly include that commitment in a signed agreement.
3.3 Fees and taxes. Customer will pay the subscription and usage charges specified in its Order when due. Managed Inference is metered and charged on the basis stated in the Order.
Unless the Order states a different basis, Managed Inference is charged at the metered cost Oshyn incurs with the provider or routing provider plus the service charge percentage stated in the Order. The model prices displayed in the Service include that service charge. Any Managed Inference credits included in a plan or Order are expressed in those displayed prices. Charges above included credits are incurred only where Customer has authorized them in the Order or in the Service and are limited to the spending cap Customer set, which the Service applies approximately. Figures displayed in the Service are estimates; the invoice follows the provider's metered cost. Where the Order permits Customer to supply its own OpenRouter credentials, usage on those credentials is not charged by Oshyn.
Charges owed directly to a BYOK provider or another Third-Party Service are governed by Customer's agreement with that provider. Applicable transaction taxes are additional unless the Order states otherwise; Customer is not responsible for taxes on Oshyn's net income. Oshyn will identify taxes it collects on the applicable invoice.
3.4 Price changes. Oshyn may change fees for a renewal period by notifying Customer's billing contact at least 30 days before that renewal. A change does not retroactively increase charges or change an agreed fixed price during its committed period.
3.5 Billing contact. Customer must keep its billing and notice information accurate. Designation as billing contact does not grant membership or content access: a billing contact cannot read Customer Data solely by reason of that designation. Content access requires a separate grant by an authorized Organization administrator.
3.6 Service changes. Oshyn may maintain and improve the Service. Changes do not release Oshyn from commitments in an Order or this Agreement. No service-level credit, dedicated support arrangement, or guaranteed availability level applies unless expressly agreed in writing.
4. Payment failure and billing suspension
4.1 Notice and grace. If payment fails, Oshyn will notify Customer's billing contact and Organization administrators. The Organization continues operating during a grace period ending at the earlier of: (a) $100 in total AI spend across models after the payment failure, as measured by the Service's usage records at the prices displayed in the Service; or (b) 14 days after the payment failure. The allowance is a grace threshold, not a waiver of otherwise payable charges or a guarantee that authorized usage cannot exceed that amount.
4.2 End of grace. When grace expires, Oshyn will suspend the Organization. The Service will stop starting new Runs and restrict access as described in section 4.3. Different arrangements in a separately signed agreement remain subject to section 1.3.
4.3 Access during billing suspension. Authorized Members retain read and export access to the Customer Data they are permitted to access. New Runs and ordinary writes are disabled. Protective actions remain available, including removing Members, revoking credentials or shared access, rotating secrets, and closing the Organization, subject to the acting person's permissions. Section 5.3 explains other limitations of read-only access.
4.4 Restoration. Once the overdue payment causing the billing restriction is successfully paid, Oshyn will restore the access restricted for that payment failure. Payment does not remove an independent security or legal restriction under section 13, reverse completed external actions, or reinstate an Organization already closed under section 5.
5. Cancellation, closure, and Customer Data
5.1 Voluntary cancellation. Customer may cancel through the account portal or, where the Order so provides, by written notice to Oshyn. Unless a signed agreement specifies otherwise, cancellation takes effect when submitted. For 30 days after cancellation, Authorized Members retain read-only access for review and export; new Runs and ordinary writes are disabled. The Organization closes at the end of that period. Cancellation does not cancel charges already incurred. Any credit or refund for unused prepaid Service is governed by the Order, an express refund provision in this Agreement, or applicable law.
5.2 Nonpayment and expiration. Oshyn may close an Organization that remains unpaid after billing suspension, on written notice to Customer. In that case, the 30-day read-only export period begins on the closure date. On expiration or termination of the subscription or Order authorizing an Organization's operation, the signed agreement's access and data provisions apply if there are any; otherwise the end date is treated as the cancellation date under section 5.1. Ending one Order does not close an Organization while another Order continues to authorize its operation. Closure for nonpayment follows the distinct sequence stated in this section.
5.3 Limited functionality. Read-only access preserves the review and export rights expressly stated here; it does not preserve normal operation of the Service. Other features, integrations, automated tasks, and external connections may be restricted or unavailable even if not individually listed. These limitations do not reduce the express review and export rights, except to the extent access must be restricted under section 13 to address a security threat or comply with law.
5.4 Retention after closure. Subject to section 5.6, Oshyn retains the closed Organization's Customer Data for 365 days from closure to permit reinstatement intact, with the same identifiers, or export at Customer's request. The retention period begins on closure even where the 30-day export period in section 5.2 runs concurrently. Retention does not extend the paid subscription or permit new processing at Customer's direction. Reinstatement requires restoration of Customer's subscription and resolution of the reason for closure; Oshyn will not impose a reinstatement charge that Customer has not agreed to.
5.5 Deletion. At the end of the retention period, Oshyn will delete the Organization's active stores, files, logs, and audit records. Residual backup copies are removed through the backup-retention cycle disclosed in the retention schedule and remain subject to the Agreement's confidentiality and use restrictions until removed. They are not retained to resume ordinary use after deletion. Copies Customer has exported or sent to its own Third-Party Services are outside Oshyn's deletion control.
5.6 Legal requirements and retained records. A binding deletion or return obligation under applicable law or an executed DPA takes priority over the default 365-day period. Oshyn may retain records it is legally required to retain, including applicable financial records, and the limited suppression records needed to honor unsubscribe or removal requests. Retention under this exception does not authorize further use of the Organization's content for ordinary Service operations. Applicable confidentiality and security duties continue for retained Customer Data.
6. Customer Data, Output, and intellectual property
6.1 Customer rights. As between Customer and Oshyn, Customer retains all rights in Customer Data, including context windows and materials in Members' personal spaces. Oshyn acquires no ownership interest in Customer Data under this Agreement. This allocation does not transfer rights belonging to an Authorized User or another third party, determine ownership of an outside account, or extinguish an individual's rights under applicable law.
6.2 Output. To the extent Oshyn acquires transferable intellectual-property rights in Output generated for Customer through the Service, Oshyn assigns those rights to Customer. This assignment does not include the Service itself, third-party materials, or rights Oshyn does not hold. It does not establish that Output is eligible for copyright or other protection, is exclusive to Customer, or can be used without regard to third-party rights. Other customers may receive similar or identical Output.
6.3 Limited processing permission. Customer permits Oshyn, and the providers Oshyn engages to perform the Service, to host, copy, transmit, display, and otherwise process Customer Data only as reasonably necessary to provide, secure, and support the Service, carry out Customer's authorized instructions, and comply with law. This permission is subject to the confidentiality provisions and any applicable DPA, continues only for those purposes during permitted retention, and does not authorize advertising use or model training.
6.4 No model training. Oshyn will not use Customer Data to train AI models. Providing feedback, enabling a connector, or using a beta feature does not waive this commitment. Processing by Customer's independently contracted BYOK providers is addressed in section 9.
6.5 Service technology. Oshyn and its licensors retain their rights in the Service, its software, designs, and supporting technology. Customer receives only the access and use rights expressly granted. Customer-specific materials do not become Oshyn's merely because they are stored in the Service, and Oshyn's preexisting technology does not become Customer's merely because it is used to process Customer Data.
7. Credentials and connected accounts
7.1 Authority to connect. Customer must have authority to connect each outside account, supply its credentials, and authorize the intended operations. Saving a password, token, API key, or connection does not transfer ownership of the outside account or expand the rights granted by its account holder or provider. Customer must not authorize operations prohibited by that provider's applicable terms or by law.
7.2 Custody and control. The Organization's credentials vault is held for Customer. Member-controlled credentials remain subject to the Member's authorization and the Service's access controls. The Service suspends use of a Member's personal saved sign-ins when that Member is deactivated. Credentials validly transferred to Organization control may be administered for authorized organizational use independently of that Member, subject to the permissions of the outside account holder and provider. Such a transfer concerns credential custody and use; it is not a transfer of the outside account itself.
7.3 Protection and authorized processing. Oshyn will encrypt stored credential secret values and restrict their processing to authorized Service functions, support and security needs, and legal obligations. Ordinary credential views mask secret values, although identifiers such as usernames may be visible. The Service may decrypt credentials to perform authorized operations and include encrypted credential records in backups and authorized Organization exports. These safeguards do not represent that the system is technically incapable of accessing a secret. Personnel access remains subject to section 12 and any separately agreed access restrictions.
7.4 Revocation. Revoking access within ContextCloud does not revoke an outside account or reverse an action already completed there. Customer remains responsible for using the outside provider's controls when it needs to revoke a provider credential, terminate an outside session, or stop further use outside the Service.
8. Administrators, Members, Guests, and sharing
8.1 Customer administration. Customer designates its administrators and is responsible for their membership, role, sharing, and configuration decisions. Oshyn may act on instructions from an authorized administrator within that administrator's permitted role. Customer must promptly remove access it no longer authorizes and notify Oshyn of suspected compromise affecting the Service.
8.2 Personal spaces. A personal space remains within Customer's Organization; its name does not establish a separate personal account or determine legal ownership. Customer is responsible for choosing lawful access and inspection settings, providing required notices, and honoring the applicable personal-space addendum. Neither Customer's administration rights nor these terms waive an individual's nonwaivable privacy, employment, or data-protection rights.
8.3 Guests and shared links. Customer decides what content to share and with whom, and must have authority to make that disclosure. Depending on the sharing method, possession of a link may permit access without Organization membership. Customer must consider that risk before distributing a link. A Guest receives only the access Customer authorizes; a Guest does not become an administrator, billing contact, or representative authorized to bind Customer merely by opening the link.
8.4 User obligations and acceptance. Customer will ensure that Authorized Users comply with the AUP and access restrictions applicable to their use. Where Oshyn requires separate end-user terms, users must receive notice and an opportunity to accept or decline them. Oshyn will require a Guest's express acceptance of the applicable guest terms before granting access to shared content; a Guest who declines will not receive that access. Customer's acceptance of this Agreement does not by itself establish an individual Guest's acceptance, waive that individual's rights, or authorize acceptance on the individual's behalf.
8.5 Responsibility. Customer is responsible for its Authorized Users' use within the access Customer grants and for its instructions and sharing decisions. That responsibility does not excuse Oshyn's own breach of the Agreement or make Customer responsible for unauthorized activity to the extent caused by Oshyn's breach.
9. AI services, automated actions, and third parties
9.1 Provider relationships. For BYOK and other Third-Party Services that Customer connects under its own account, Customer contracts with the provider and is responsible for reviewing its terms, permissions, charges, and data-handling practices. Connecting a service authorizes the data transfers needed to carry out Customer's configured use. A Customer-selected provider is not Oshyn's subprocessor merely because ContextCloud transmits requests to it. Oshyn remains responsible for its own transmission and processing obligations.
9.2 Managed Inference. Providers engaged through Oshyn's accounts to process Managed Inference are addressed in the subprocessor register and any applicable DPA. Oshyn will not authorize those providers to use Customer Data to train models and will apply routing controls that exclude providers identified as training on request content. Restrictions on training do not by themselves establish zero retention: logging, security review, caching, and retention must be assessed under the applicable provider arrangements. Oshyn does not promise zero retention by every model provider unless a signed agreement expressly includes that commitment.
9.3 Output review. AI Output may be inaccurate, incomplete, non-unique, or unsuitable for a particular use. Oshyn does not undertake human review of each Output. Customer must assess Output before relying on, publishing, or acting on it, with human oversight appropriate to the consequences. Output is not a substitute for qualified professional advice where such advice is required. This provision does not displace Oshyn's express obligations concerning the Service or applicable indemnification obligations.
9.4 External actions. An agent or automated workflow may use enabled tools to transmit information, send messages, incur charges, or create, modify, or delete records outside ContextCloud. AI agents may misunderstand or fail to follow instructions, choose an inappropriate tool or recipient, repeat an action, or otherwise act differently from Customer's intent, even when instructions are clear. An action may incur unintended charges or have consequences that cannot be reversed by canceling a Run. Customer must not assume that every external action will prompt for a separate confirmation.
Customer is responsible for deciding which workflows to automate, granting permissions appropriate to those workflows, and configuring available scope, review, and approval settings. Customer must use human oversight proportionate to the consequences and, where available and appropriate, restrictions enforced by the connected provider. Customer should not enable unattended actions where it cannot accept the disclosed residual risk.
9.5 Controls and allocation of responsibility. Customer acknowledges the limitations of AI automation described above and accepts the risk of unintended results from the workflows it elects to enable, subject to Oshyn's express obligations and the allocation of liability in this Agreement. An instruction in a prompt, including an amount the agent is told not to exceed, is not an enforced spending limit. An agent's statement that it will comply does not create such a limit or amend the Agreement.
Guardrails, approval settings, budgets, and spending controls reduce risk within their documented scope; they do not guarantee that every action will match Customer's intentions. A budget for AI usage does not limit purchases or other charges in a connected system unless the applicable control expressly covers those charges. Oshyn will describe the scope and material limitations of an offered control before Customer enables it. Customer must review that information rather than assume a control applies to every credential, connection, or external action.
Customer's acceptance of automation risk does not deem every unexpected action authorized or excuse Oshyn from providing controls it has expressly committed to provide. A failure of such a control does not create an undertaking to insure Customer against, or reimburse Customer for, every resulting loss. Claims arising from agent actions or control failures, including claims for unintended expenditure, remain subject to sections 15 through 17 and the express treatment of ordinary automation failures in section 16.4. Charges owed to a connected provider are governed by Customer's relationship with that provider; this Agreement governs any separate claim between Customer and Oshyn.
9.6 Availability and third-party terms. A provider may change or withdraw a model, interface, or integration. Oshyn does not guarantee continued availability of a particular third-party offering unless expressly agreed. This does not excuse Oshyn from an obligation it has assumed under an Order or DPA. Customer-selected Third-Party Services remain subject to their own terms; Oshyn does not grant rights in them or warrant their independent performance.
10. Optional administration by Oshyn
If Customer separately engages Oshyn to help administer its Organization, a signed Order or statement of work will define the authorized services, personnel access, responsibilities, fees, and any special audit requirements. Oshyn personnel may access Customer Data only within that authorization and remain subject to section 12. This arrangement does not give Oshyn ownership of Customer Data or authority to act outside the agreed scope. An ordinary subscription does not include this administration service.
11. Personal data, subprocessors, and locations
11.1 Processing roles. For personal data in Customer Data processed on Customer's behalf, Customer determines its purposes and instructions, and Oshyn acts as processor or subprocessor as applicable. Customer is responsible for the legal basis, notices, and permissions necessary for its collection, use, and disclosure of that data. Oshyn is responsible for compliance with the laws applicable to its own processing and performance.
11.2 Separate DPA. The DPA is available for separate execution; accepting these terms does not execute it. Before processing Customer Data that requires a data-processing agreement or international-transfer instrument, the parties must put the required terms in place. Neither party may treat the absence of a signature as permission to process data unlawfully. The executed DPA governs processing instructions, subprocessor duties, data-subject assistance, incident notification, return or deletion, and applicable transfer safeguards.
11.3 Oshyn's account records. Oshyn processes its own business-contact, subscription, and billing records for its relationship with Customer as described in the Privacy Notice. That notice does not expand Oshyn's permission to use Customer Data or override a DPA.
11.4 Providers and locations. The Service's principal hosting is in the United States. Hosting locations and providers engaged by Oshyn are identified in the subprocessor register, which Oshyn will update before a change takes effect, subject to any longer notice required by an executed DPA. US hosting is not a promise that every model request, support activity, or Customer-selected integration is processed only in the United States. Any specific residency restriction must be expressly agreed and supported by the applicable configuration.
12. Security and confidentiality
12.1 Safeguards. Oshyn will maintain administrative, technical, and organizational safeguards reasonably appropriate to the Service and the Customer Data it processes. The Service provides logical separation between Organizations, encryption of stored authentication secrets, role-based access controls, multi-factor authentication that administrators may require, and controls for Members to revoke their own ContextCloud login sessions and authorized administrators to revoke Members' sessions within the Organization. MFA enrollment periods and trusted-device settings may apply. These provisions do not promise dedicated infrastructure, encryption of every category of stored data, or protection against every possible incident.
12.2 Shared responsibilities. Customer must use reasonable safeguards for its accounts, devices, credentials, permissions, and connected systems. Customer's responsibilities supplement rather than replace Oshyn's obligations. Additional security, backup, audit, or service commitments apply only where expressly agreed in an executed DPA or another signed agreement.
12.3 Confidential Information. Each party's “Confidential Information” includes information disclosed in connection with the Agreement that is marked confidential or should reasonably be understood to be confidential in context. Customer Data is Customer's Confidential Information regardless of marking. Nonpublic Service technology and security information are Oshyn's Confidential Information.
12.4 Use and access. A receiving party will use Confidential Information only to perform the Agreement or exercise rights it expressly grants. It will protect that information with reasonable care, using no less care than it uses for its own comparable information. Disclosure is limited to personnel, advisers, and permitted service providers who need the information for those purposes and are subject to duties protecting it. The receiving party is responsible for their compliance with this section; an applicable DPA may impose additional requirements.
12.5 Exceptions. Information is not subject to section 12.4 to the extent the receiving party can demonstrate that it became public without a breach, was already lawfully known without a confidentiality duty, was lawfully received from another source without such a duty, or was independently developed without use of the disclosed information. These exceptions do not eliminate protections independently required by privacy law or an applicable DPA.
12.6 Required disclosure. A party may disclose Confidential Information to the extent legally compelled. Unless legally prohibited, it will give the other party advance notice and reasonable cooperation in seeking protection or narrowing the disclosure. It will disclose only what the legal requirement demands.
12.7 Incidents and continuing protection. Oshyn will notify Customer without undue delay after becoming aware of a security incident resulting in unauthorized access to, use, disclosure, alteration, destruction, or loss of Customer Data processed by Oshyn or its subcontractors, and will provide information reasonably available to assist Customer's response. Any earlier trigger or specific deadline in applicable law or an executed DPA controls. Notification is not an admission of liability. Confidentiality obligations continue while retained information remains confidential, including during the periods in section 5.
13. Acceptable use and protective restrictions
13.1 Compliance. Each party will comply with laws applicable to its performance. Customer and its Authorized Users must comply with the AUP, respect third-party rights, and use the Service only within their authorization. They must not circumvent access restrictions, interfere with another tenant, misuse credentials, or use the Service in violation of applicable sanctions or export restrictions.
13.2 Protective suspension. Oshyn may restrict affected access where it reasonably determines that use materially violates the Agreement, threatens the security or integrity of the Service or another person, or must be restricted by law. Oshyn will ordinarily give notice and a reasonable opportunity to resolve the issue. It may act immediately where delay would create a material risk or violate law, and will then provide notice as soon as reasonably possible unless prohibited.
13.3 Scope and restoration. Oshyn will limit a protective restriction to what is reasonably necessary and restore affected access when its basis is resolved. It will preserve the review and export rights in section 5 where doing so is lawful and does not perpetuate the threat. Payment-related restrictions are governed by section 4; this section is not an alternative means of avoiding its grace provisions.
14. Beta and pilot offerings
A beta or pilot offering is subject to the separately accepted Beta Terms for its scope and duration. Those terms may address availability, support, feature changes, fees, and beta-specific risk. They do not amend a separately signed enterprise agreement except as that agreement permits. Using a beta does not authorize model training with Customer Data under these terms. On conclusion of the beta, continued paid use requires the applicable subscription arrangements; otherwise the agreed cancellation and data-handling provisions apply.
15. Warranties and disclaimers
15.1 Mutual authority. Each party represents that it has authority to enter into and perform the Agreement. Customer further represents that it has the rights and permissions necessary to provide its Input and other Customer Data and authorize the processing and actions it requests.
15.2 Service commitment. Oshyn will perform the Service with reasonable skill and care and in accordance with its express obligations in the Agreement. A disclaimer below does not negate an express warranty, security obligation, confidentiality duty, or DPA commitment.
15.3 Disclaimers. Except for the express commitments in the Agreement, and to the extent legally permitted, the Service and Output are provided on an “as is” and “as available” basis. Oshyn disclaims implied warranties of merchantability, suitability for a particular purpose, and noninfringement. Oshyn does not warrant uninterrupted or error-free operation, the accuracy or completeness of Output, the legal protectability of Output, or that the Service will satisfy requirements not expressly agreed. This disclaimer does not limit an indemnity expressly provided in section 17 or a right that law does not permit the parties to exclude.
16. Limits on liability
16.1 Excluded damages. Subject to section 16.3, neither party is liable under or in connection with the Agreement for indirect, consequential, special, or punitive damages, or for lost profits, lost revenue, or loss of data, even if advised of the possibility.
16.2 Financial limit. Subject to section 16.3, each party's aggregate liability under or in connection with the Agreement is limited to the fees Customer paid for the Service during the 12 months immediately preceding the first event giving rise to liability. If that event first occurs after the Agreement ends, the measuring period is the 12 months immediately preceding its end. This is a combined limit across Orders and claims; additional claimants, related events, or legal theories do not multiply it. It applies whether a claim is framed in contract, tort, or another legal theory.
16.3 Exceptions. Neither section 16.1 nor section 16.2 limits liability for (a) a party's breach of the confidentiality duties in sections 12.3 through 12.6 or the incident notification and continuing protection duties in section 12.7; (b) a breach of the security duties in sections 12.1 or 12.2 that results in unauthorized access to, use, disclosure, alteration, destruction, or loss of Customer Data; (c) Customer's payment obligations; (d) either party's obligations under section 17; (e) a party's fraud or willful misconduct; or (f) liability that applicable law does not permit the parties to limit. These exceptions apply to both the excluded-damages provision and the financial limit.
16.4 Ordinary automation failures. Subject to the express exceptions in section 16.3, the exclusions and financial limit in sections 16.1 and 16.2 apply to claims arising from errors in agent actions or automated workflows and from failures of guardrails, approval settings, budgets, or spending controls, including claims based on negligence or failure to exercise the skill and care required by section 15.2. A control failure is not, by itself, a security or confidentiality breach within section 16.3 merely because the control was intended to prevent an unintended action. Where the facts also establish a breach described in section 16.3, that exception continues to apply; describing an actual security or confidentiality breach as an automation error does not remove it from that exception.
17. Defense of third-party claims
17.1 Oshyn's undertaking. Oshyn will defend Customer against a third-party claim alleging that the ContextCloud software or other Service technology provided by Oshyn, used as permitted under the Agreement, infringes that party's intellectual-property rights. Oshyn will pay damages and reasonable legal costs finally awarded against Customer on that claim, and amounts payable under a settlement Oshyn approves in accordance with section 17.4.
17.2 Scope of Oshyn's undertaking. Section 17.1 concerns the Service technology, not a separate infringement undertaking for Customer's Input, generated Output, or a Customer-selected Third-Party Service. It does not cover a claim to the extent caused by a modification not made or authorized by Oshyn, a combination with items not supplied or authorized by Oshyn where the claim would not otherwise arise, or use outside the Agreement. These exclusions do not relieve Oshyn of responsibility for components it selects and incorporates into its own Service technology. Any indemnity concerning model Output must be expressly agreed in writing; an upstream provider's indemnity is not automatically transferred to Customer.
17.3 Customer's undertaking. Customer will defend Oshyn against a third-party claim alleging that Customer's Input or other materials supplied for processing violate that party's intellectual-property, privacy, or other legal rights, or that Customer's or its Authorized Users' use breaches the Agreement or applicable law. Customer will pay damages and reasonable legal costs finally awarded against Oshyn on that claim, and amounts payable under a settlement Customer approves in accordance with section 17.4. Customer does not owe a defense or indemnity solely because unmodified Output was generated, used, or distributed in the intended use of the Service. That exception does not protect Customer's supply of infringing Input or knowing use of infringing Output. Customer has no obligation under this section to the extent a claim results from Oshyn's breach of the Agreement.
17.4 Procedure. The party seeking protection must promptly give written notice of the claim, permit the defending party to direct the defense using competent counsel, and provide reasonable assistance at the defending party's expense. A delay in notice relieves an obligation only to the extent it materially prejudices the defense. The protected party may participate through its own counsel at its own expense. Neither party may settle a covered claim in a way that requires the protected party to admit wrongdoing, assume an unpaid obligation, accept a material nonmonetary restriction, or relinquish rights beyond the claim without that party's prior written consent, not to be unreasonably withheld.
17.5 Infringement measures. If a covered claim threatens continued use, Oshyn may obtain the needed rights or provide a materially equivalent noninfringing modification or replacement. If neither is commercially reasonable, Oshyn may terminate the affected Service and refund prepaid fees attributable to its unused portion. The agreed export and data-handling rights remain available, subject to lawful protective restrictions. These measures do not erase a defense or payment obligation already incurred under this section.
18. Term and termination
18.1 Duration. The Agreement continues while an Order remains in effect, unless terminated under its terms. Expiration or termination ends ordinary use rights but does not terminate the limited data-access rights, retention duties, or other surviving provisions expressly stated here.
18.2 Material breach. Either party may terminate for the other's material breach if the breach remains uncured 30 days after written notice describing it. This does not prevent the billing consequences in section 4 or necessary protective action under section 13. If Customer terminates under this section for Oshyn's uncured material breach, Oshyn will refund prepaid fees attributable to the unused portion of the terminated Service.
18.3 Consequences. Fees properly incurred before termination remain payable. Data access and disposition follow section 5 or the controlling signed agreement. Termination does not release either party from liability already accrued. Provisions concerning ownership, permitted retention, confidentiality, outstanding fees, liability, third-party claims, governing law, and the enforcement of surviving rights continue for as long as their purpose requires.
19. Changes to the Agreement
Oshyn will identify published versions of these terms by version and date. A material change to Customer's rights or obligations requires express acceptance by a person authorized to bind Customer and applies from that acceptance, not retroactively. A nonmaterial change may take effect on its stated date after notice; continued use after that date constitutes acceptance. A change is not nonmaterial merely because Oshyn labels it that way. A change to an incorporated policy may not be used to evade this section or expand the permitted use of Customer Data. A separately signed agreement may be amended only as that agreement permits. Requirements imposed directly by law remain applicable irrespective of a contractual update.
20. General provisions
20.1 Governing law and courts. The Agreement is governed by the laws of the State of Delaware, excluding rules that would select another jurisdiction's laws. Subject to any controlling signed agreement, the parties consent to exclusive jurisdiction in the state and federal courts located in Delaware for disputes arising from the Agreement. This provision does not waive a right or protection that applicable law makes nonwaivable.
20.2 Notices. Legal notices to Oshyn must be sent to privacy@contextcloud.works, unless a signed agreement specifies another address. Notices to Customer may be sent to its designated billing or legal contact. A party may update its notice address by notice to the other. Email notice is effective on receipt; a delivery-failure message does not establish receipt. Routine operational communications may also be delivered through the Service.
20.3 Assignment. Neither party may transfer the Agreement without the other's written consent, except as part of a merger or sale of substantially all of the business to which it relates, if the successor assumes the obligations and the transferring party gives prompt written notice. An assignment does not reduce existing data-protection obligations.
20.4 Subcontractors. Oshyn may use subcontractors to perform the Service but remains responsible for its obligations under the Agreement. Use of subprocessors remains subject to any applicable DPA. This provision does not make Oshyn responsible for a Customer-selected Third-Party Service's independent obligations.
20.5 Events beyond reasonable control. A party is not liable for delay or failure caused by an event outside its reasonable control to the extent reasonable precautions and mitigation could not avoid it. The affected party must give reasonably prompt notice and take reasonable steps to resume performance. This provision does not excuse amounts already owed, authorize prohibited use or disclosure of Customer Data, or excuse a failure to maintain safeguards expressly promised by the Agreement.
20.6 Relationship and publicity. The parties are independent contractors. Neither may bind the other except under an express authorization. Neither may use the other's name, trademarks, or logo in customer lists, endorsements, or other publicity without prior written permission. No person other than the parties and their permitted successors receives an enforcement right under the Agreement, except where expressly provided in an executed DPA or required by law.
20.7 Entire agreement; waiver; severability. The Agreement contains the parties' agreement on its subject matter, subject always to the priority of a separately signed agreement under section 1. A delay in enforcement is not a waiver; a waiver must be express and applies only to its stated circumstances. If a provision cannot lawfully be enforced, it will be restricted only to the extent necessary, and the remaining provisions continue to apply.