# Terms of Service

*Draft pending legal review. Nothing on this page is final until counsel signs off.*

Effective date: set when counsel approves this draft.
Last updated: draft of October 30, 2026.

## 1. What these terms cover

These terms cover two things only: browsing this website, and joining the waitlist through the form at `/partners`.
They are not a service agreement.
Paid use of the Gateway, once you convert from the waitlist, runs under a separate order form,
a master services agreement (MSA), and a data processing addendum (DPA).
Where these website terms and that MSA conflict, the MSA controls for anything it covers.

Joining the waitlist does not create a service relationship, a support obligation, or a service level commitment.
It reserves your place in line.

## 2. Who we are

The Gateway is operated by [Legal entity name], a company with its registered address at [Registered address].
You can reach us at compliance@corporatesafety.io for anything about these terms.

## 3. Who may use this site

This site and the waitlist are for businesses evaluating the Gateway, not for individual consumers.
By submitting the waitlist form you confirm that you are acting for a business,
that you are old enough to form a binding contract in your jurisdiction,
and that the information you give us is accurate.
This site is not directed to children, and we do not knowingly collect information from anyone under 16.

## 4. Acceptable use

You agree not to use this site or the waitlist form to do any of the following:

- submit false, fraudulent, or misleading information
- probe, scan, or attempt to disrupt the site or its infrastructure
- upload or submit unlawful content, malware, or anything infringing someone else's rights
- scrape or harvest the site's content beyond normal browsing
- attempt to bypass rate limits, access controls, or security measures

We can suspend or refuse access for anyone we reasonably believe has broken this policy.

## 5. AI output disclaimer

The product this site describes routes requests to third-party AI model providers.
Once you are a customer, outputs from those models may be inaccurate, incomplete, or invented.
They are not legal, medical, financial, or other professional advice,
and you are responsible for reviewing any output before you rely on it or act on it.
This disclaimer will also appear, with fuller terms, in the MSA that governs paid use.

## 6. Bring your own key, and third-party providers

The product is designed so that each customer connects their own account with their chosen AI model provider.
We call this bring your own key, or BYOK.
We are not a party to your contract with that provider,
and we do not control what that provider does with your data.
We are not liable for that provider's outages, policies, pricing, or behavior.
You remain responsible for complying with your provider's own acceptable use terms.
Full BYOK terms, including each party's responsibilities, live in the MSA.

## 7. Data definitions

These definitions govern Sections 8 and 9, and the Privacy Policy uses them with the same meaning.

**Customer Content** means the prompts, documents, files, and other material you or your users send through the
Gateway, together with the model outputs returned to you.
It includes that material as submitted, before the redaction engine screens it.

**Personal Data** means any element of Customer Content that identifies or could reasonably be used to identify a
natural person or a specific organization.
For these terms it covers, at a minimum, each of the following categories:

- personal identifiers, including names, postal and email addresses, telephone numbers, and government identifiers
- payment card data, including primary account numbers and cardholder authentication data
- health identifiers, including protected health information as defined under 45 CFR 160.103
- credentials and secrets, including passwords, API keys, access tokens, and private keys
- every custom detection class your organization defines in your own policy configuration

**Fully Redacted Data** means data derived from Customer Content only after both of the following steps have
occurred, in that sequence.
First, the redaction engine has replaced every value it detects in the categories above with a generic placeholder
that names a category and a sequence position and carries no part of the original value.
Second, we have applied de-identification measures so that the result meets all three of the following conditions:

1. we have taken reasonable technical and organizational measures to ensure that the data cannot reasonably be
   linked, directly or indirectly, to any individual, household, device, or customer organization
2. we commit publicly, in Section 9.3 of these terms, to maintain and use the data only in de-identified form and
   never to attempt to re-identify it
3. we contractually obligate every recipient of the data to those same conditions, including a prohibition on
   re-identification and on onward transfer except under terms at least as protective

Data that remains reasonably linkable to a person or to your organization is not Fully Redacted Data,
and no right reserved in Section 9 applies to it.

**Aggregated Data** means statistics, counts, distributions, and other measures derived from Fully Redacted Data or
from Service Data that describe a group or category rather than any single request, person, or customer.

**Service Data** means operational metadata we generate in running the service,
such as timestamps, selected provider, latency, token counts, error codes, and counts of redaction findings by
category.
Service Data excludes Customer Content and excludes Personal Data.

The three conditions in the definition of Fully Redacted Data follow Cal. Civ. Code 1798.140(m)
and the three-part de-identification test in the FTC's 2012 privacy report.

*Note for counsel: confirm that the conditions as restated satisfy both authorities,
and the comparable de-identification definitions in other US state privacy laws.*

## 8. Our commitment on your personal data

**In plain language:** we do not log your users' personal data, we do not keep it in a form that identifies anyone,
and we do not sell it, license it, or hand it to anyone else.
The one exception is a retention class you choose and configure yourself,
and content kept under that class is held for you alone.

The following commitments apply to Personal Data within Customer Content once you are a customer.

### 8.1 We do not log it

Our logs and traces contain no prompt, no completion, no payload, and no credential.
Values that are shaped like secrets are suppressed at the logging surface itself,
by the same detector the screening stage uses, so a secret is removed before a log line is written rather than after.
User identity appears in our logs only as an opaque identifier.

### 8.2 We do not retain it in identifiable form

By default, the redaction engine screens every request before it leaves our data plane,
unless you choose by policy to send traffic without screening.
The table mapping a placeholder back to its original value exists only in the short-lived state of the conversation
that produced it, encrypted under your retention class's data key, and it expires with that state.
It never enters a request record, a capture, or an export.
No operator, process, or record of ours can reverse a placeholder once that state has expired.

We do not retain Personal Data in identifiable form,
except where you configure a retention class that retains payloads,
and then solely for you and encrypted under that class's key.
Content stored under a class you chose is your data, held on your instruction, for the period your class sets,
which defaults to 30 days.
You may also choose, by your own policy, to send traffic without screening.
In either case the choice is yours to make and yours to reverse,
and the resulting content is governed by your agreement and its data processing addendum, not by Section 9.

### 8.3 We do not sell or disclose it

We do not sell, license, rent, trade, or otherwise disclose Personal Data to any third party.
We do not share it for cross-context behavioral advertising.
We disclose it to no one except the inference provider you chose and instructed us to call,
and except where a binding legal process compels disclosure,
in which case we will give you notice unless the law forbids it.

### 8.4 What we do not claim

We describe controls, not guarantees.
We do not claim that any system is perfectly secure,
and we do not claim a certification we do not hold.
For detection classes backed by a checksum, our coverage claim holds by construction.
For every other class, including free prose, we publish a measured recall interval and make no claim of zero misses.

## 9. Reserved rights in Fully Redacted Data

**In plain language:** once data has been redacted and then de-identified, so that it no longer points to any person
or to your company, we reserve the right to study it, to improve the service with it, to train our own models on it,
and, in the future, to license or sell it.
We will tell you before we first license or sell it to anyone,
and an enterprise customer can switch the training and licensing uses off.

This section is a reservation of rights distinct from Section 8.
Nothing in it applies to Customer Content or to Personal Data, which Section 8 governs without qualification.

### 9.1 Reserved uses

Subject to Sections 9.2 through 9.7, we reserve the right to use, reproduce, and create derivative works of Fully
Redacted Data and Aggregated Data for each of the following purposes, and for no others:

(a) building and refining routing tables, task-class taxonomies,
and evidence of quality and cost across models and providers

(b) operating, improving, securing, troubleshooting, and developing the service

(c) training, fine-tuning, and evaluating models that we or our licensors own

(d) licensing, sharing, or selling Fully Redacted Data and Aggregated Data to third parties,
a right we reserve for the future and have not exercised as of the last updated date of these terms

Background sampling, which runs masked requests to calibrate cost and quality estimates,
and the routing classifier, which trains on sampled and masked traffic,
operate under subsections (a) and (b).

### 9.2 What Fully Redacted Data never includes

Fully Redacted Data never includes your organization's name, your users' names, any credential or secret,
or any confidential identifier of yours.
Anything we use under this section is stripped of your organization's identity as well as of every individual's,
so no exercise of these rights discloses that you are a customer, or what your traffic contains.

### 9.3 Our commitment not to re-identify

We commit, publicly and as a term of this agreement, to maintain and use Fully Redacted Data only in de-identified
form, and never to attempt to re-identify it or to link it to any individual, household, device, or organization.
We do not retain, and do not reconstruct, any key or mapping that would permit re-identification.

### 9.4 Obligations on recipients

We will not license, share, or sell Fully Redacted Data or Aggregated Data to any third party unless that recipient
first agrees in writing to each of the following:

- not to attempt to re-identify the data or to combine it with other data for that purpose
- not to transfer it onward except to a recipient bound by terms at least as protective as these
- to permit our audit of its compliance, and to delete the data on our written request

A recipient's breach of those terms entitles us to terminate its license and to require deletion,
and we will pursue those remedies.

### 9.5 Prospective effect only

The rights in Section 9.1 apply only to Customer Content processed after you accept these terms,
or after you accept a later amendment that first introduces them.
We never apply a looser policy retroactively to data received under a stricter one.

### 9.6 Notice, and your opt-out

We will give you advance written notice before the first time we license or sell Fully Redacted Data or Aggregated
Data to a third party under Section 9.1(d).

An enterprise customer may opt out of Sections 9.1(c) and 9.1(d) by order form or by its master services agreement,
without change to pricing.
The opt-out is exercisable by any administrator your organization authorizes, and we will confirm it in writing.

Your master services agreement and data processing addendum must name the purposes in Section 9.1 as permitted
processing purposes, as Article 28(10) of the GDPR requires,
and the rights in this section do not operate until they do.

### 9.7 Health data

We use data derived from protected health information only where both of the following hold:
the data has been de-identified in accordance with 45 CFR 164.514(b),
by expert determination or by the safe harbor method, and any business associate agreement between us expressly
permits that de-identification and the resulting use.
Where either condition fails, the data is excluded from Section 9 entirely.

*Note for counsel: a sale or license of de-identified patient information engages Cal. Civ. Code 1798.148,
which prescribes specific contract terms. Confirm whether Section 9.4 needs those terms written out before any
health-adjacent license proceeds.*

*Note for counsel: the CCPA's de-identification carve-out at 1798.145(a)(5) runs to a "business."
We act as a service provider for Customer Content, and the Attorney General has not extended the carve-out to a
service provider. Confirm whether we may invoke it ourselves, or whether the customer must grant the right.*

*Note for counsel: under GDPR Recital 26 and EDPS v SRB (C-413/23 P), redaction alone yields pseudonymised data
rather than anonymised data where the controller retains linking means. Confirm that the decision ledger and the
expiring placeholder table do not leave us holding such means, and confirm the EU anonymisation threshold we assert.*

### 9.8 Ownership

You own Customer Content, and nothing in these terms transfers it to us.
We own Fully Redacted Data, Aggregated Data, and Service Data, together with every model, routing table, and taxonomy
we derive from them.
Sections 9.3 and 9.4 survive termination of your agreement,
and our rights under Section 9.1 survive termination only for data already de-identified before termination took
effect.

## 10. Our intellectual property

The site's design, text, graphics, and underlying code belong to us or our licensors.
You may view and print pages for your own evaluation of the product.
You may not copy, resell, or create derivative works from this site without our written permission.

## 11. No warranty

This site and the waitlist are provided "as is" and "as available," without warranties of any kind.
That includes implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
We do not warrant the site will be uninterrupted, error-free, or secure.

## 12. Limitation of liability

To the fullest extent the law allows, we are not liable for any indirect, incidental, special, consequential,
or punitive damages arising from your use of this site or the waitlist,
even if we were advised such damages were possible.
Our total liability for any claim arising from this site or the waitlist is limited to one hundred US dollars.
Nothing in this section limits liability that cannot lawfully be limited,
such as liability for our own gross negligence, willful misconduct, or breach of confidentiality.
A separate, higher liability framework applies under the MSA once you are a paying customer.

## 13. Indemnity

You agree to defend and indemnify us against claims, damages, and expenses arising from your breach of these terms,
or from your misuse of the site or the waitlist form.

*Note for counsel: decide whether to add a mutual indemnity for site content, which is uncommon in website terms.*

## 14. Term and termination

These terms apply from the first time you visit this site or submit the waitlist form,
and continue until you stop using the site or we discontinue it.
We can remove a waitlist entry, or suspend a visitor's access to the site, at our discretion.
We would do this, for example, to address a breach of Section 4 or a legal or security risk.
Sections 7, 8, and 9 on data, and the sections on intellectual property, warranty, liability, and indemnity,
survive any termination, each to the extent Section 9.8 and its own terms provide.

## 15. Changes to these terms

We can update these terms as the site and the waitlist change.
We will post the new effective date at the top of this page,
and for a material change we will also email you if you are on the waitlist.
Continued use of the site after a change means you accept the updated terms.
A change that first introduces, or materially broadens, a right reserved under Section 9 takes effect only
prospectively, and for a paying customer only on that customer's affirmative acceptance.

## 16. Governing law

These terms are governed by the laws of [Governing state], without regard to its conflict-of-laws rules.
Any dispute arising from these terms is decided by the state and federal courts located in [Governing state].
You agree to that venue.
We have not elected mandatory arbitration or a class-action waiver for this site.

## 17. Export control and sanctions

You represent that you are not located in, or a national of, a country subject to comprehensive US sanctions.
You also represent that you are not on any US government restricted-party list.
You agree to comply with applicable US export control and sanctions laws,
including the Export Administration Regulations and OFAC sanctions programs,
in your use of the site, the waitlist, and, once you are a customer, the product.
We can decline or suspend access to anyone where serving them would put us in breach of those laws.

## 18. Notices

We will send notices about these terms, or about your waitlist entry,
to the email address you give us on the waitlist form.
You can send us a notice at compliance@corporatesafety.io.

## 19. General terms

If a court finds part of these terms unenforceable, the rest stays in effect.
These terms, together with our [Privacy Policy](/privacy),
are the entire agreement between us about the website and the waitlist,
and replace any earlier agreement on that subject.
You may not assign these terms without our consent.
We may assign these terms in connection with a merger, acquisition, or sale of our business.
Neither of us is liable for a delay caused by events outside our reasonable control.

Questions about these terms go to compliance@corporatesafety.io.