Terms of service.

1.1 validant.ai is a brand of Glinz & Company GmbH ("we", "us"). These Terms cover the website validant.ai and the platform at platform.validant.ai (together, the "Services").

1.2 The open-source vfairness library is governed by the Apache License 2.0 alone. These Terms add no conditions to it.

1.3 Where we sign an order form, a statement of work or a master agreement with you (an "Order"), the Order applies together with these Terms and wins where the two differ, for what the Order covers.

1.4 If you accept these Terms for an organisation, you confirm that you may bind it.

• Customer or you: the person or organisation that uses the Services.
• Organisation: a workspace on the platform, with its members, plan and data.
• Authorised user: a person you invite to your organisation.
• Your content: data, datasets, documents, model details, credentials and other material you upload to or create in the Services.
• Output: analyses, scores, findings, reports, dashboards and other results the Services produce for you.
• AI output: output produced with the help of an AI model.
• Seal: a Trust Seal or a report seal as described in section 18.
• Credits: the units in which the platform counts the use of its AI features.
• Consumer: a person who uses the Services mainly for private purposes.

3.1 You accept these Terms by confirming them when you sign up or, if you already have an account, when the platform asks you to. Where we ask you to confirm them, we keep a record of the version and the time. Using the website alone means you accept the parts of these Terms that apply to the website.

3.2 We may change these Terms. We tell you about a material change at least 30 days before it applies, by email and in the platform. If you do not agree, you may cancel before the change applies, and we refund any prepaid fees for the time after that. Clarifications and terms for new features apply when we publish them.

3.3 Each version carries a number and a date. Earlier versions stay readable at the end of this page.

4.1 You must be at least 18 and able to enter into a binding contract. Give accurate details and keep them current.

4.2 Each organisation has an owner, who controls its members, plan, billing and settings. Members have one of the roles Owner, Admin, Project Lead, Analyst, Reviewer or Viewer. You are responsible for what your authorised users do as if you had done it yourself.

4.3 Keep your sign-in, password, passkey and recovery codes safe and use multi-factor authentication where we offer it. Tell us at once at security [at] validant [dot] ai if you suspect misuse of your account.

5.1 The Services exist to build trust in AI systems. You will not, and will not let anyone else:

• use the Services for anything unlawful, fraudulent, defamatory or infringing;
• use them for an AI practice prohibited by Article 5 of the EU AI Act, or to violate fundamental rights;
• upload content you have no right or lawful basis to process, including personal data without the consents or notices the law requires;
• probe, scan or test the security of the Services without our written permission (we welcome responsible disclosure at security [at] validant [dot] ai);
• get around usage limits, credits, access controls or rate limits;
• reverse engineer the Services, except where the law allows it, or use the Services or their output to build or train a competing service;
• resell the Services or give access to people outside your organisation, unless an Order allows it.

5.2 Content you share with others in the platform (in collaboration boards, messages, comments or support tickets) must also respect these rules. To report content you believe is illegal, write to legal [at] validant [dot] ai with where it is, why you believe it is illegal, and your name and email. We review every report with care, act on it, and tell you and the person concerned what we decided and how to contest it.

5.3 If you breach this section, we may remove the content concerned or suspend access under section 24.

6.1 You keep all rights in your content. You give us the right to host, process, transmit and display it only as needed to provide the Services to you, for as long as we provide them.

6.2 The sensitive content of your assessments (descriptions, uploaded data, workbench and result data) is encrypted in your browser before it is stored. We cannot read that content in storage, we cannot screen it, and we cannot recover it if you lose your password and recovery codes. When you run an analysis, the data it needs is decrypted only inside our analysis engine, on machines we operate, for the time of the run. Some information stays readable to the platform so that it can work, for example assessment titles and the summaries AI features use as context; the Privacy Policy describes it.

6.3 Datasets you upload for a run are deleted automatically three days after their last upload. Keep your own copy of anything you need.

6.4 We may use figures about how the Services are used (for example counts of runs or errors) to run and improve them. These figures never contain your content.

7.1 Each of us keeps the other's non-public information confidential, uses it only for these Terms, and shares it only with people who need it and are bound to the same duty. This lasts during the contract and for three years after it ends; trade secrets stay protected for as long as they remain secret.

7.2 This does not cover information that is public through no fault of the recipient, was already known to it, was developed independently, or must be disclosed by law or a court, after notice to the other side where the law allows.

8.1 How we handle personal data for our own purposes is set out in the Privacy Policy.

8.2 For personal data in your content, you are the controller and we are your processor. Sections 8.3 to 8.9 are our data processing agreement under Article 28 of the GDPR and Article 9 of the Swiss Federal Act on Data Protection. You can ask for a signed copy at privacy [at] validant [dot] ai.

8.3 We process that data only to provide the Services, on your documented instructions, which are these Terms, your use of the Services and any written instruction you give us, for as long as we provide the Services. The data and the people concerned are whatever you upload; you decide what that is.

8.4 Everyone at our company who can access the data is bound to confidentiality. We protect the data as section 9 describes.

8.5 You authorise us in general to use the providers listed in the subprocessor register. We bind each of them to the same data protection duties, announce a new or replaced provider at least 30 days in advance, and you may object on reasonable grounds; if we cannot meet the objection, you may end the affected service.

8.6 Where data leaves Switzerland or the EEA for a country without an adequate level of protection, we rely on the standard contractual clauses or another safeguard the law recognises.

8.7 We help you, as far as we reasonably can, to answer requests from the people concerned, to secure the data, to deal with a breach, and with impact assessments and consultations with authorities.

8.8 At the end of the Services we delete the data as section 24.4 describes, unless the law requires us to keep it.

8.9 We give you the information you need to show that these duties are met, and allow audits by you or an auditor you appoint, with reasonable notice, at your cost and no more than once a year unless a breach gives reason for more.

9.1 We protect the Services and your content with appropriate technical and organisational measures, including encryption in transit and at rest, encryption of assessment content in your browser, access control and logging.

9.2 If a security breach affects personal data in your content, we tell you without undue delay and help you meet your own duties.

9.3 You protect your own devices, accounts and keys, and decide who in your organisation has access.

10.1 Parts of the Services run on providers we choose: sign-in (Auth0), hosting (Supabase, in Zurich), content delivery (Cloudflare), email (Resend), AI models (Google's Gemini API) and, once paid plans are switched on, payments (Stripe). We remain responsible to you for the Services.

10.2 Where you connect your own providers (for example a model endpoint, see section 20), their terms apply between you and them.

11.1 We own the Services, their software, methods, texts, templates and design, and everything we develop from them. You get a limited, non-exclusive, non-transferable right to use the Services under these Terms for as long as your account or Order runs. Our trademarks and the licences that apply are set out on the Copyright & Licensing page.

11.2 You may use the output for any purpose of your own. Where an Order says more about output, the Order applies.

11.3 If you send us suggestions or feedback, we may use them freely and without obligation to you.

12.1 The Services and their output, including AI output, support human judgement. They are not legal, regulatory, financial or other professional advice, and they do not guarantee compliance with any law or standard, a certification, an audit result or any other outcome.

12.2 Output can be incomplete, outdated, biased or wrong, and AI output can contain statements that sound right but are not. Check output before you rely on it, and ask qualified advisers where needed.

12.3 A person must stay responsible for any decision that has legal, financial, employment, health, safety or similarly significant effects on someone. The Services must not be the sole basis for such a decision.

13.1 The platform offers the plans shown on the pricing page when you choose one; that page forms part of your contract. Enterprise features, service levels and custom work are available only under an Order. Without an Order there is no service-level commitment.

13.2 A new organisation starts with a 14-day trial with the credits and limits the pricing page states. To keep working after the trial, choose a plan.

13.3 Prices are in Swiss francs. VAT is added where it applies.

13.4 A beta discount, where offered, is fixed for 12 months from your first paid period. After that the plan renews at the standard price, and for an annual plan we remind you before it renews.

13.5 Payments are not switched on yet. Until they are, no payment is taken, and we will tell you before any first charge.

14.1 Paid plans are paid in advance through Stripe and renew for the same period until you cancel. If a payment fails, you can update your payment details in the billing portal; until the payment succeeds, features that need a paid plan may stop working.

14.2 You can cancel or change your plan at any time in the billing portal. A cancellation takes effect at the end of the paid period, and you keep access until then. A downgrade may reduce seats, credits and features from the next period.

14.3 We may change prices with at least 30 days' notice. A new price applies from your next renewal after the notice period, and you may cancel before it applies.

15.1 Every payment for a subscription, an upgrade or a credit pack comes with a 14-day money-back guarantee, for consumers and business customers alike. If you are not satisfied, tell us at legal [at] validant [dot] ai within 14 days of the payment and we refund it in full, no reason needed. For a credit pack, the refund covers the credits not yet used.

15.2 For consumers in the EU and the EEA this also honours the statutory right of withdrawal (section 27). We do not ask you to give up that right when you start using the platform.

16.1 Each plan includes a monthly allowance of credits. Monthly credits that are not used lapse at the end of the billing cycle.

16.2 Credits you buy as a pack go into your organisation's shared pool, carry over between billing cycles and do not expire while the organisation exists.

16.3 Credits have no cash value and cannot be transferred to another organisation, except as section 15 provides.

17.1 Access to a plan through a partner programme lasts until the end date stated when it was granted, or until the grant is withdrawn. When it ends, the organisation keeps full access for 7 days with the credits it holds, then read-only access for 30 days, and after that the access of an organisation without a plan.

17.2 Where access to a plan comes from sponsoring the vfairness library, it ends when the sponsorship ends. A sponsorship supports the library; it is not the purchase of a service level or a guarantee.

18.1 A Trust Seal is a signed digital credential. It states that a named AI system, in a named version, was assessed on a stated date with the fairness measures and thresholds the seal carries, by the method version it names, and with the result it shows. A seal is not a certificate of a system's quality, safety or lawfulness, and not a conformity assessment under the EU AI Act. Issuing seals to customers is not switched on yet; this section applies from when it is.

18.2 You may show a seal issued to you only for the system and version it names, unchanged, and together with a link to its public check. The seal mark and its design remain ours.

18.3 A seal is valid for 365 days from issue. A seal is revoked when the assessment behind it is reopened. We may also revoke it if the system changes in a way that affects the result, if the information you supplied was wrong, or if the seal is shown in a misleading way. You remove a seal that has expired or been revoked from everything you control without delay.

18.4 Anyone can check a seal and its current status, without an account, at validant.ai/verify. We publish the status of every seal we issue.

18.5 A seal is only as accurate as the data and descriptions you supplied. You are responsible for them.

18.6 A report seal on a PDF report shows who produced the report and that it has not been changed since. It does not state that the findings in the report are correct.

19.1 Some features use AI models: the assistant, explanations, drafts and agent tasks run on Google's Gemini API, and the deep assessment model runs on machines we operate. When you use such a feature, what you enter and the context the feature needs are sent to the model that runs it.

19.2 We do not use your content to train AI models, and we choose providers whose terms do not allow them to train on the data we send.

19.3 In the Report Builder, text generated with AI is marked as such. Section 12 applies to all AI output.

19.4 Under the EU AI Act we are the provider of the AI features we build into the Services. Where you use the Services to assess or run your own AI system, you are the provider or deployer of that system and keep the duties that come with it.

20.1 When you connect a model endpoint, you confirm that you may let us call it. We call it only for runs you or your authorised users start.

20.2 Access keys you give us are stored encrypted with your organisation's key. You can replace or remove them at any time, and you should revoke them at your provider when you no longer need them.

20.3 Charges your model provider makes for these calls are yours, and its terms apply to you.

20.4 When you import evidence (for example a file from MLflow or from your build pipeline), you confirm that it is accurate and that you may share it with us.

21.1 For paid plans and Orders we provide the Services with professional care and in line with the law, and output produced under an Order substantially matches what the Order describes.

21.2 Otherwise, and for the trial, free access and features marked beta, the Services are provided as they are and as available. To the extent the law allows, we give no further warranties, in particular none that the Services will be uninterrupted or free of errors.

22.1 Our total liability for all claims in any 12-month period is limited to the fees you paid us in the 12 months before the event that caused the claim, or CHF 500 if you paid nothing.

22.2 We are not liable for indirect or consequential loss, lost profit, or lost data that you could have kept a copy of.

22.3 These limits do not apply to intent or gross negligence, to injury to life or health, or to any liability the law does not allow to be limited. Consumers keep every right the law where they live gives them.

23.1 This section applies to business customers only. You defend and hold us harmless against third-party claims that arise from your content or from your use of the Services in breach of these Terms. We defend and hold you harmless against third-party claims that the Services, used as these Terms allow, infringe their intellectual property.

23.2 The side that seeks protection tells the other promptly, lets it lead the defence and helps reasonably.

24.1 We may suspend access, in whole or in part, if you seriously breach these Terms, if your use puts the Services or other customers at risk, if a payment remains unpaid after notice, or if the law requires it. We tell you in advance where we can, and restore access once the reason is gone.

24.2 You can stop using the Services at any time and ask for your account to be deleted in your profile settings. We confirm your identity and complete the deletion within 30 days.

24.3 Either of us may end the contract if the other seriously breaches these Terms and does not put it right within 30 days of written notice, or at once if the other becomes insolvent. We may end free access with 30 days' notice.

24.4 After the end you have 30 days to download your reports and content while signed in. Because your content is encrypted with your keys, only you can export it in readable form. After that period we delete it, except where the law requires us to keep records.

24.5 Business customers in the EU may switch to another provider under the EU Data Act. We act on a switching request within two months, support a transition period of 30 days, and charge nothing for switching.

24.6 Sections that by their nature should last beyond the end (among them 6, 7, 11, 12, 22, 23, 25 and 26) continue to apply.

25.1 These Terms are governed by Swiss law. The UN Convention on Contracts for the International Sale of Goods (CISG) does not apply.

25.2 The courts at our registered seat in the Canton of Zurich, Switzerland, have exclusive jurisdiction, unless an Order provides for arbitration.

25.3 If you are a consumer, you keep the protection of the mandatory law of the country where you live, and you may bring proceedings in its courts. We can bring proceedings against a consumer only there.

• Entire agreement and precedence. These Terms, the documents they refer to and any Order are the whole agreement. An Order wins over these Terms, and these Terms win over the pricing page.
• Assignment. You may transfer the contract only with our written consent, which we will not refuse without good reason. We may transfer it to a company that takes over the Services.
• Severability and waiver. If a provision is invalid, the rest stays in force and the invalid provision is replaced by a valid one that comes closest to its purpose. Not enforcing a right is not a waiver of it.
• Force majeure. Neither of us is liable for a delay or failure caused by events outside reasonable control.
• Notices. Notices to us go to legal [at] validant [dot] ai. Notices to you go to the email address of your account.
• Language. These Terms are written in English. If we provide a translation, the English text prevails.
• Export control and sanctions. You confirm that you are not subject to Swiss, EU, UK or US sanctions and will not use the Services in breach of export control or sanctions law.
• Publicity. We name you as a customer, or show your logo, only with your consent.

27.1 If you are a consumer living in the EU or the EEA, you may withdraw from a paid contract within 14 days of concluding it, without giving reasons. To do so, send us a clear statement, for example by email to legal [at] validant [dot] ai. You may use this form, but you do not have to:

"To Glinz & Company GmbH, Zollikerstrasse 98, 8702 Zollikon, Switzerland, legal [at] validant [dot] ai: I hereby withdraw from my contract for the following service: [plan or credit pack], ordered on [date]. Name, address, date."

27.2 We refund all payments for the contract within 14 days of receiving your withdrawal, using the same means of payment. We do not charge you for the time you already used the service.

27.3 A monthly or annual plan can be cancelled online at any time in the billing portal (section 14).

Questions about these Terms, notices and reports of illegal content: legal [at] validant [dot] ai. Security: security [at] validant [dot] ai. Privacy: privacy [at] validant [dot] ai. Our company details are in the imprint.