Legal & Compliance

1. About these terms and the parties

These Terms of Service (the "Terms") form a binding agreement between Witnium Technologies AB, reg. no. 559416-7453, Tyska Skolgränd 4, 111 31 Stockholm, Sweden ("Witnium", "we", "us") and the legal entity that creates an account or uses the service (the "Customer", "you"). The Terms govern all access to and use of the Beeable platform, including the websites beeable.company and app.beeable.company, all digital colleagues, tools, apps, interfaces, APIs and associated services (together, the "Service").

By creating an account, ticking your acceptance of the Terms or using the Service, you confirm that you have read, understood and accepted the Terms, the Acceptable Use Policy, the Digital Colleagues & AI Policy and the Service Level Agreement, all of which form an integral part of the agreement. Our processing of personal data on the Customer's behalf is additionally governed by the Data Processing Agreement.

2. For businesses and organisations only

The Service is provided exclusively to businesses, non-profit associations, foundations and other organisations for use in their operations. The Service is not directed at consumers, and consumer protection legislation — including the Swedish Distance and Off-Premises Contracts Act (2005:59) — does not apply to the agreement.

The individual who creates the account warrants that they are authorised to represent and bind the Customer to these Terms. In the absence of such authority, that individual is personally liable for the obligations under the agreement. Users of the Service must be at least 18 years old.

3. Definitions

Digital colleague

An AI-based software service provided with a name, a visual appearance and a professional role (for example lawyer, sales manager, scout, archivist or meeting facilitator). A digital colleague is a computer program — not a human being, not an employee of the Customer or of Witnium, and not a natural or legal person. The name, portrait and persona are an interface that makes the software easier to work with, nothing more.

Tools

The applications included in or activatable within the Service (for example customer records, legal tools, archives, prospecting tools and boards) which the Customer can work in directly, have a digital colleague work in, or both.

The Office

The Customer's overall workspace in the Service, including the Customer's digital colleagues, tools, settings and users.

Customer Data

All data, content and information that the Customer or the Customer's users enter into, upload to or generate in the Service, including information about the Customer's own customers, contacts, members, suppliers, contracts and documents.

Output

Text, documents, proposals, analyses, compilations and other content generated for the Customer by a digital colleague or a tool.

Credits

The consumption unit that measures use of the Service's AI-powered features and that is included in subscriptions or purchased as top-ups.

4. The account

The Customer is responsible for keeping account details accurate and up to date, for storing login credentials securely, and for all activity that occurs through the Customer's account and users. The Customer must notify us immediately of any suspected unauthorised access. The Customer's administrator controls which users are invited and what permissions they receive, and the Customer is fully responsible for its users' actions in the Service.

An account may not be shared between several legal entities, sold, rented out or transferred without our written approval.

5. Service content, beta features and changes

Beeable is under continuous development. New digital colleagues and tools are added, existing ones are improved, and features may be changed, merged or removed. We reserve the right to change the content, design and technical implementation of the Service at any time. For changes that materially degrade the Service's core functionality for the Customer, we will make commercially reasonable efforts to give advance notice.

Features may be labelled beta, preview or similar ("Beta Features"). Beta Features are provided as is, may be changed or discontinued without notice, are not covered by the Service Level Agreement, and are used at the Customer's own risk.

6. Digital colleagues — what they are and how responsibility works

For complete clarity: when you work with a digital colleague, you are working with an AI system. This applies to every digital colleague in the Service, regardless of its name, its role or how natural the conversation feels. A digital colleague:

• is software and has no legal capacity — it cannot enter into agreements, make undertakings or bear liability;
• is not an employee of the Customer, and no employment, agency or other similar relationship arises between the Customer and a digital colleague, or between the Customer and Witnium, through use of the Service;
• acts only within the Service and only on the basis of the Customer's instructions, configuration and approvals;
• generates content using probability-based language models and may therefore make mistakes, misunderstand, or provide incomplete or outdated information.

Everything a digital colleague does in the Service is done on the Customer's behalf and, as between the parties, counts as the Customer's own actions. The Customer is responsible for how Output is used, for actions the Customer has colleagues perform (for example mailings or publications), and for ensuring that such use complies with applicable law.

7. Duty of review — you approve before it counts

Output is working material. The Customer must always review Output with judgement and its own expertise before it is used, sent, published, signed or relied on for decisions. This applies in particular to Output of a legal, financial, tax, medical or other professional nature.

The Service does not constitute legal advice, the practice of law, auditing, tax advice, financial advice or any other regulated advisory activity, and no client or engagement relationship of that kind arises through use of the Service. A digital colleague with a legal, financial or other professional role is a qualified working tool — not a substitute for a licensed or certified adviser. For matters of material importance, the Customer should engage qualified human advice.

8. Customer Data and the Customer's responsibilities

The Customer owns its Customer Data. The Customer is responsible for ensuring that Customer Data is lawful, that the Customer is entitled to enter it into the Service, and that the processing has a legal basis under the General Data Protection Regulation (EU) 2016/679 ("GDPR") — this includes information about the Customer's own customers, prospects, members and contact persons. The Customer is further responsible for ensuring that mailings, marketing and outreach carried out with the help of the Service comply with the Swedish Marketing Act (2008:486), the GDPR and good marketing practice.

We process personal data in Customer Data only as a processor on the Customer's behalf, in accordance with the Data Processing Agreement. The Customer grants us a non-exclusive right to process Customer Data to the extent required to provide, operate, secure and improve the Service and to perform the agreement.

9. Intellectual property

The Service and everything in it — including the platform, the software, the design, the trademarks, the digital colleagues' names, personas and visual appearances, and all other material provided by us — belongs to Witnium or our licensors and is protected by intellectual property law. The Customer receives a limited, non-exclusive, non-transferable right to use the Service during the term of the agreement, for the Customer's internal operations and in accordance with the Terms. No other rights are granted.

The Customer may freely use Output in its business. To the extent Output is covered by rights vesting in us, we assign those rights to the Customer upon generation of the Output, except for elements of Output that form part of the Service (for example templates, the colleagues' personas or our brand material). We give no warranty that Output is unique, does not infringe third-party rights, or can be registered as an intellectual property right — similar output may be generated for other customers.

If the Customer provides suggestions, feedback or ideas about the Service, we may use these freely and without compensation. We may use aggregated and anonymised information about use of the Service for operations, statistics and improvement of the Service.

10. Prices, credits and payment

Current prices, subscription tiers and credit volumes are shown in the Service. All prices are stated exclusive of VAT. Subscription fees are paid in advance per contract period. Payment is made through our payment service provider (currently Stripe); we do not store full card details.

• Credits are consumed when the Service's AI-powered features are used, at the consumption rates shown in the Service. Consumed credits are not refunded.
• Credits included in a subscription are valid for the period in which they were allocated. Purchased top-up credits remain valid for as long as the account is active. All credits expire without compensation when the agreement ends.
• Credits have no monetary value, are not redeemable for money and cannot be transferred.
• We may change prices and consumption rates with at least thirty (30) days' notice; the change takes effect at the next contract period. If the Customer does not accept the change, the Customer may terminate the agreement effective at the end of the current period.
• In the event of non-payment, we may, after a reminder, suspend the Customer's access to the Service until payment has been made in full, and charge late-payment interest and statutory fees.

New accounts may be granted welcome credits with no payment card required. Welcome credits are a discretionary benefit that may be changed or withdrawn, have no value, and confer no right to continued access once consumed.

11. Term, termination and suspension

The agreement runs from account registration for the subscription period chosen by the Customer, renewing automatically until terminated. The Customer may terminate the agreement at any time in the Service, effective at the end of the current period. Fees already paid are not refunded, except where required by mandatory law or expressly provided in these Terms.

We may terminate the agreement with thirty (30) days' notice. In addition, we may suspend the Customer's access to the Service, in whole or in part, or terminate the agreement with immediate effect if (a) the Customer materially breaches the Terms or the Acceptable Use Policy, (b) the Customer's use creates a security risk, a legal risk or a risk of harm to us, other customers or third parties, (c) payment is not made despite a reminder, or (d) it is required by law or by a decision of a public authority. No compensation or refund is payable in the event of suspension under this section.

12. Data at the end of the agreement

For thirty (30) days after the agreement ends, the Customer may request an export of its Customer Data in a commonly readable format. Thereafter, Customer Data is deleted or anonymised in accordance with the Data Processing Agreement. We have no obligation to retain Customer Data after the export window closes, beyond what mandatory law requires.

13. No warranties

The Service is provided as is and as available. Beyond what is expressly stated in the Service Level Agreement, we make no warranties of any kind, express or implied, regarding the Service — including but not limited to warranties as to the accuracy, completeness or currency of Output, uninterrupted or error-free operation, fitness for the Customer's particular purpose, or that defects will be corrected. AI-generated content may contain errors; responsibility for review rests with the Customer under section 7.

14. Limitation of liability

Except to the extent mandatory law provides otherwise, the following applies. Neither party is liable for indirect or consequential damage, such as loss of profit, loss of revenue, loss of business opportunities, loss of goodwill, third-party claims, or loss of data beyond what follows from our backup undertaking.

Witnium's aggregate liability under the agreement, on any basis, is limited to an amount equal to the fees the Customer has paid for the Service during the twelve (12) months preceding the event giving rise to the liability. For outages and shortfalls in availability, service credits under the Service Level Agreement are the Customer's sole remedy. These limitations do not apply in cases of intent or gross negligence, nor to liability that cannot be limited under mandatory law.

Claims against us must be made in writing without undue delay and no later than three (3) months after the Customer became aware, or ought to have become aware, of the basis for the claim, failing which the right to bring the claim is forfeited.

15. Indemnity

The Customer shall indemnify and hold harmless Witnium, our group companies and our representatives against third-party claims, including reasonable legal costs, arising from (a) Customer Data, (b) the Customer's use of the Service or Output in breach of the Terms or applicable law, (c) instructions the Customer has given to digital colleagues, or (d) the Customer's breach of section 8.

16. Third-party dependencies

The Service depends on services from third parties, including providers of AI language models, data sources, hosting and database services, and payment services. We are not liable for faults, interruptions, changes or discontinuation of such third-party services beyond our reasonable control, but we will take commercially reasonable measures to limit the impact on the Service, for example by switching provider.

17. Force majeure

A party is relieved from liability for failure to perform an obligation caused by circumstances beyond its reasonable control, such as war, acts of terrorism, natural disaster, fire, flood, epidemic, labour dispute, widespread failures in power or communications networks, action by public authorities, or changes in law. The obligation to pay fees that have fallen due is not affected.

18. Changes to the Terms

We may amend the Terms and the associated policies. Material changes will be announced in the Service or by email at least thirty (30) days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the changes. A Customer who does not accept a material change may terminate the agreement effective on the date the change takes effect. Changes required by law or for security reasons may take effect immediately.

19. Assignment

The Customer may not assign the agreement without our written consent. We may assign the agreement, in whole or in part, to companies within the same group or in connection with a restructuring, merger or transfer of the business or a material part of it, and we may engage subcontractors to perform our obligations.

20. Miscellaneous

Notices to the Customer are given in the Service or to the email address registered on the account, and are deemed received when made available. Notices to us are sent to admin@witnium.com. These documents are provided in Swedish and in English; the Swedish version is the original and legally binding version, and in the event of any discrepancy the Swedish version prevails. The Terms, together with the associated policies and the Data Processing Agreement, constitute the parties' entire agreement regarding the Service and supersede prior arrangements on the same subject matter. If any provision is held invalid, the validity of the remaining provisions is not affected; the provision shall be adjusted only to the extent necessary.

21. Governing law and disputes

The agreement is governed by Swedish substantive law, excluding its conflict-of-law rules. Disputes arising from the agreement shall be settled by the Swedish general courts, with the Stockholm District Court (Stockholms tingsrätt) as the court of first instance, unless the parties agree otherwise in writing.

1. Who is responsible — and our two roles

Witnium Technologies AB, reg. no. 559416-7453, Tyska Skolgränd 4, 111 31 Stockholm, Sweden, is the controller for the processing described in this policy: information about visitors to our websites, about people who contact us, and about the Customer's users to the extent the processing concerns the account, billing, security and the operation of our own business.

For personal data contained in Customer Data — for example information about the Customer's own customers, contacts and members entered into the tools or mentioned in conversations with digital colleagues — the Customer is the controller and we are the processor. That processing is governed by the Data Processing Agreement, not by this policy. Data subjects who wish to exercise rights regarding such data should first contact the customer whose organisation the data belongs to; we assist the Customer in responding.

2. Data we process

• Account data: name, email address, organisation, role, language choice and settings.
• Payment data: billing details and payment history. Card details are handled by our payment service provider; we never store full card numbers.
• Usage and technical data: logs of logins and material events, IP address, device and browser information, error reports, and aggregated feature usage.
• Communications: email and messages to us, for example support cases.
• Cookies and similar technologies: as described in our Cookie Policy.

We do not knowingly collect sensitive personal data (special categories under Art. 9 GDPR) about users, and we ask you not to provide such data to us outside the Service.

3. Purposes and legal bases

4. How AI models are used — please read this

Beeable's digital colleagues are powered by large language models from third-party providers. When you write to a digital colleague, or when a tool uses an AI feature, the text and material needed to perform the task are sent to such a provider for processing, after which the response is returned to the Service. The following applies to this processing:

• We have agreements with all model providers prohibiting the use of your data to train or improve their models.
• The transfer is encrypted, and we share only the information required for the task at hand.
• Model providers are processors or sub-processors and are bound by data protection terms equivalent to ours.
• We never sell personal data, and we do not use the content of your conversations for advertising.

A full description of how the digital colleagues work, are supervised and are constrained can be found in the Digital Colleagues & AI Policy.

5. Google user data (Google Calendar integration)

If you connect a Google account to Beeable, we access your Google Calendar data through Google APIs, and only the data covered by the permissions you approve on Google's consent screen. Depending on the permissions you grant, this may include your calendar list, events and their details (titles, times, attendees, descriptions and locations), and your free/busy status.

How we use it. We use Google user data solely to provide the calendar features you choose to use in Beeable: showing your schedule, checking availability, and creating, updating or deleting events on your behalf when you or a digital colleague acting under your supervision asks for it. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.

With whom we share, transfer or disclose it. We do not share, transfer or disclose Google user data to any third party, except in the following limited cases:

• Sub-processors that host and operate the Service on our behalf (hosting and database services), bound by data protection terms equivalent to ours.
• AI language model providers, only where you ask a digital colleague to perform a task that requires calendar data, and then only the information needed for that task, under agreements that prohibit its use for training or improving their models (see section 4).
• Public authorities where required by law or by a decision of a public authority.
• An acquirer or group company in connection with a restructuring or transfer of the business, in which case this policy continues to apply and you will be notified.

Where Google user data is processed by a provider outside the EU/EEA, the transfer safeguards described in section 7 apply.

Storage and deletion. We store Google user data only for as long as the integration is connected and as needed to provide the features described above. You can disconnect the integration at any time in your Beeable settings or by revoking access at myaccount.google.com/permissions, after which we delete the associated Google user data within thirty (30) days, subject to the backup rotation described in section 8.

Limited Use. Beeable's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Recipients and sub-processors

We share personal data only with (a) providers processing data on our behalf within the following categories: hosting and database services, providers of AI language models, payment services, email and communication services, and analytics services; (b) public authorities where required by law or by a decision of a public authority; and (c) acquirers or group companies in connection with a restructuring or transfer of the business, in which case this policy continues to apply. A current list of sub-processors is available on request via admin@witnium.com.

7. Where the data lives — and transfers outside the EU/EEA

Our starting point is EU first: storage and operations take place primarily in the EU (the Stockholm and Frankfurt regions). Some processing — mainly AI processing — may involve transfers to providers in the US or other third countries. Such transfers take place only under valid transfer mechanisms in accordance with Chapter V of the GDPR: the European Commission's Standard Contractual Clauses with supplementary safeguards, or adequacy decisions, including the EU–US Data Privacy Framework where the provider is certified. A copy of the applicable safeguards can be requested via the contact details below.

8. Retention periods

• Account data: for the term of the agreement and then for the thirty (30) day export window, after which deletion or anonymisation takes place within ninety (90) days. Backups subsequently rotate out according to our backup cycle.
• Accounting records: seven (7) years under the Swedish Accounting Act.
• Security and access logs: up to twelve (12) months, unless longer retention is required for the investigation of an incident or a legal claim.
• Support communications: up to twenty-four (24) months after a case is closed.

9. Your rights

You have the right to request access to your personal data, rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest — including direct marketing, where an objection is always honoured. Consent may be withdrawn at any time without affecting the lawfulness of prior processing. Requests are made via admin@witnium.com; we respond without undue delay and at the latest within one month. You also have the right to lodge a complaint with IMY, the Swedish Authority for Privacy Protection (imy.se).

10. No solely automated decision-making

We make no decisions about you that are based solely on automated processing and that produce legal effects or similarly significantly affect you, within the meaning of Art. 22 GDPR. The Service is moreover built so that a human reviews and approves the digital colleagues' work before it takes effect — see the Digital Colleagues & AI Policy.

11. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, row-level data isolation between customers, role-based access on a least-privilege basis, audit logging, continuous backups with point-in-time recovery, and a separate external backup. In the event of a personal data breach posing a risk to data subjects' rights, we act without undue delay and notify those affected in accordance with the GDPR.

12. Children and minors

The Service is directed at businesses and organisations and is not intended for persons under 18. We do not knowingly collect data about children.

13. Changes and contact

We may update this policy; material changes will be announced in the Service or by email before they take effect. Questions about this policy or our processing of personal data may be directed to Witnium Technologies AB, Tyska Skolgränd 4, 111 31 Stockholm, Sweden, or admin@witnium.com.

1. Background, parties and roles

This Data Processing Agreement (the "DPA") is entered into between the Customer, as controller, and Witnium Technologies AB, reg. no. 559416-7453 (the "Processor"), as processor, and forms an integral part of the Terms of Service (the "Main Agreement"). The DPA satisfies the requirements of Art. 28(3) GDPR and applies to all processing of personal data carried out by the Processor on the Customer's behalf within the Service.

2. Subject matter of the processing

The Service is not intended for the processing of sensitive personal data (Art. 9 GDPR), data relating to criminal offences (Art. 10 GDPR), or data covered by specific confidentiality legislation. If the Customer nevertheless enters such data, it does so at its own responsibility, and the Customer is responsible for the lawfulness of the processing.

3. Documented instructions

The Processor processes personal data only on the Customer's documented instructions, which consist of the Main Agreement, this DPA, and the Customer's configuration and use of the Service's features — including the assignments the Customer gives its digital colleagues. Processing beyond this takes place only where required by Union or Swedish law, in which case the Processor shall inform the Customer of the legal requirement before processing, unless such information is prohibited. If the Processor considers that an instruction infringes the GDPR, it shall inform the Customer without delay; the Processor may then suspend execution of the instruction.

4. Confidentiality

The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under a statutory duty of confidentiality, and that access is limited to what each person needs for their duties.

5. Security measures

The Processor implements technical and organisational measures in accordance with Art. 32 GDPR, appropriate to the risk of the processing, including:

• encryption of personal data in transit and at rest;
• logical data isolation between customers through row-level security;
• role-based access on a least-privilege basis and multi-factor authentication for administrative access;
• audit logging of material events;
• continuous backups with point-in-time recovery and a separate, geographically distinct backup;
• documented procedures for incident management, change management and disaster recovery;
• contractual data protection and security requirements imposed on all sub-processors.

The Processor may update the measures over time, provided the level of protection is not materially reduced.

6. Sub-processors

The Customer gives general prior authorisation for the Processor to engage sub-processors within the following categories: hosting and database services, providers of AI language models, payment services, email and communication services, and analytics services. A current list of sub-processors is available on request via admin@witnium.com.

The Processor shall inform the Customer of intended additions or replacements of sub-processors at least thirty (30) days in advance. The Customer may object on reasonable data protection grounds within fourteen (14) days of the notice. If the parties cannot find a solution within a reasonable time, the Customer may, as its sole remedy, terminate the Main Agreement effective at the end of the current contract period. The Processor imposes on each sub-processor data protection obligations equivalent to those in this DPA and remains liable to the Customer for the sub-processor's processing as for its own.

7. Assistance to the Customer

Taking into account the nature of the processing and the information available to it, the Processor shall assist the Customer (a) with appropriate technical and organisational measures so that the Customer can fulfil its obligation to respond to data subjects' requests to exercise their rights under Chapter III of the GDPR — primarily through the Service's built-in functions for search, export, rectification and erasure — and (b) in fulfilling the Customer's obligations under Arts. 32–36 GDPR. If a data subject contacts the Processor directly, they are referred to the Customer, and the Customer is informed. For assistance materially beyond the Service's built-in functions, the Processor may charge reasonable compensation at its then-current rates.

8. Personal data breaches

The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data, and in any event within seventy-two (72) hours. The notification shall, to the extent the information is available, describe the nature of the breach, the categories of data subjects and data affected, the likely consequences, and the measures taken and planned; information may be provided in stages. The Processor documents breaches and assists the Customer with material for any notification by the Customer to the supervisory authority and communication to data subjects. Responsibility for assessing whether notification is required, and for notifying, rests with the Customer.

9. Information and audits

The Processor shall make available to the Customer the information necessary to demonstrate compliance with the obligations in Art. 28 GDPR. Review takes place primarily through written questions and through available audit reports, certifications and summaries of security documentation. The Customer additionally has the right, itself or through an independent auditor who is not a competitor of the Processor, to conduct an audit at most once per twelve-month period, upon written notice at least thirty (30) days in advance, during normal office hours, and in a manner that does not jeopardise the security or confidentiality of other customers. Each party bears its own costs; the Processor's participation beyond a reasonable extent is compensated by the Customer. The frequency limitation does not apply in the event of an incident or at the request of a supervisory authority.

10. Transfers to third countries

Processing takes place primarily within the EU/EEA (the Stockholm and Frankfurt regions). Transfers to third countries — mainly for AI processing at model providers — take place only under a valid transfer mechanism in accordance with Chapter V of the GDPR: the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) with supplementary safeguards where required, or adequacy decisions, including the EU–US Data Privacy Framework where the recipient is certified. The Customer authorises the Processor to enter into such clauses with sub-processors on the Customer's behalf to the extent necessary.

11. Deletion and return

Upon termination of the Main Agreement, the Customer may for thirty (30) days export Customer Data via the Service or request delivery in a commonly readable format. Thereafter, the Processor deletes or anonymises all personal data processed on the Customer's behalf within ninety (90) days, after which remaining copies in backups rotate out according to the backup cycle and are kept inaccessible for active processing until then. Data may be retained longer only to the extent storage is required by Union or Swedish law, and then only for that purpose.

12. Liability

The parties' liability under this DPA is subject to the liability provisions of the Main Agreement, including its limitation of liability, except to the extent mandatory law — including Art. 82 GDPR in relation to data subjects — provides otherwise. Administrative fines imposed on a party as a result of that party's own infringement of the GDPR are borne by that party.

13. Term and order of precedence

The DPA remains in force for as long as the Processor processes personal data on the Customer's behalf. In the event of a conflict between the DPA and the Main Agreement, the DPA prevails in matters concerning the processing of personal data.

1. What cookies are

Cookies are small text files stored in your browser when you visit a website. We use cookies and similar technologies (such as local storage) on beeable.company and app.beeable.company. This policy describes which categories we use, why, and how you control them. Processing of personal data in connection with cookies is covered by our Privacy Policy.

2. Categories we use

We do not use cookies for third-party marketing, and we never sell data collected via cookies. A detailed, current list of individual cookies, their providers and lifetimes is available in the cookie settings on the website.

3. Consent — and how to change your mind

Non-essential cookies are set only after you have given consent via our cookie banner. You can withdraw or change your consent at any time via the cookie settings link on the website, with effect going forward. You can also block or delete cookies in your browser settings; if essential cookies are blocked, parts of the Service may stop working.

4. Retention periods

Session cookies are deleted when the browser is closed. Persistent cookies have a fixed lifetime shown in the list in the cookie settings and never longer than the purpose requires, as a rule no more than twelve (12) months.

5. Changes and contact

We may update this policy when our use of cookies changes; the date at the top shows the latest version. Questions may be directed to admin@witnium.com.

1. The basic principle

This policy applies to all use of the Service and forms part of the Terms of Service. The Service is built for legitimate work in businesses and organisations. The Customer is responsible for its own and its users' use, including the assignments given to digital colleagues — for the purposes of this policy, an instruction to a colleague is the Customer's own action.

2. Prohibited use

The Service may not be used to:

• violate law, decisions of public authorities or third-party rights, including intellectual property rights, trade secrets and the right to privacy;
• create, distribute or enable fraudulent, deceptive, defamatory, threatening, harassing or discriminatory content;
• develop, distribute or control malicious code, or carry out intrusion attempts, denial-of-service attacks, circumvention of access controls or other attacks against the Service or third parties;
• collect or process personal data without a legal basis, or monitor, map or profile individuals in an improper manner;
• send spam or other unsolicited mass marketing in breach of the Swedish Marketing Act, the GDPR or equivalent foreign regulation;
• scrape, copy, decompile or reverse-engineer the Service, circumvent technical restrictions, or use the Service to develop or train a competing service or model;
• resell, rent out or provide the Service to third parties as your own service without a written agreement with us;
• impersonate someone else, or use the Service under a false identity.

3. Special rules for digital colleagues and AI features

In addition to section 2, the following applies to all use of the Service's AI features. The Customer may not:

• use the Service for practices prohibited under Art. 5 of the EU AI Act, Regulation (EU) 2024/1689 — including manipulative or deceptive techniques that distort people's behaviour and cause harm, exploitation of vulnerabilities, social scoring, and emotion recognition in the workplace or in education;
• use the Service for purposes that constitute high risk under Annex III of the AI Act — for example as the decisive basis for decisions on employment, dismissal, credit, insurance, admission to education, the exercise of public authority, or access to essential services — without our express written approval and without itself fulfilling the obligations that then rest on the Customer under the Regulation;
• present AI-generated content as human-created in contexts where this is misleading or where labelling is required by law, or remove labelling provided by the Service;
• allow a digital colleague to present itself as a human being in contact with third parties;
• attempt to circumvent the Service's safety controls, supervision or content restrictions, including through prompt injection, or induce a digital colleague to act in breach of this policy;
• make decisions with legal or similarly significant effects for individuals solely on the basis of Output, without genuine human review.

4. Mailings and outreach

Tools for customer outreach, prospecting and mailings may only be used for lawful marketing and contact. The Customer is responsible for having a legal basis for processing recipients' data, for honouring unsubscribes, and for ensuring the content is not misleading. We may limit volumes and features to protect deliverability, recipients and the reputation of the Service.

5. Capacity and fair use

Use must stay within the account's credit volume and reasonable capacity limits. We may introduce technical restrictions (for example rate and volume limits and daily cost caps) to protect the stability of the Service and the experience of all customers. Systematic attempts to circumvent the metering or billing of consumption are prohibited.

6. Security testing and reporting

Security testing of the Service may only take place with our written approval. Anyone who discovers a vulnerability is asked to report it responsibly to admin@witnium.com and not to exploit, share or publish it before we have had reasonable time to remedy it.

7. Consequences of violations

In the event of a violation of this policy we may, depending on severity, warn the Customer, remove content, restrict features, suspend the account in whole or in part, or terminate the agreement with immediate effect in accordance with the Terms of Service — without any refund of fees paid or compensation for expired credits. We may also take legal action and, where required, inform the relevant authorities. Suspected abuse can be reported to admin@witnium.com.

1. Always open about what you are talking to

When you work with a digital colleague in Beeable, you are interacting with an AI system. This applies without exception — regardless of the colleague's name, role, portrait or how naturally the conversation flows. The colleagues are consistently presented as digital in the Service, on our websites and in our materials, in accordance with the transparency requirements of Art. 50 of Regulation (EU) 2024/1689 of the European Parliament and of the Council (the "AI Act"). No feature of the Service is designed to conceal that you are interacting with AI.

2. What a digital colleague is

A digital colleague is an AI-based software service with three components: (a) one or more large language models that generate text and analyses, (b) a real tool — an application containing your data, which you can work in yourselves, have the colleague work in, or both — and (c) a persona: a name, a portrait and a professional role that make the software understandable and easy to work with. The persona is an interface. The names and portraits do not depict real people.

3. What a digital colleague is not

• Not a human. No human reads your conversations with a colleague as part of delivering the service. Human access occurs only for support at your request, for security and troubleshooting, or where the law requires it.
• Not an employee. No employment relationship arises — not with you, not with us. Words like "hire", "colleague" and "recruitment" in the Service are product language, not legal statements.
• Not an adviser in a regulated sense. A colleague with a legal, financial or other professional role is a qualified working tool. It does not practise law, auditing or other regulated advisory services, and no client relationship arises.
• Not an agent with a will of its own. A colleague acts only within the Service, only on your configuration and instructions, and cannot enter into agreements or make undertakings on your behalf or ours.
• Not a bearer of liability. Software cannot bear liability. Responsibility for the Service rests with Witnium under the Terms of Service; responsibility for its use rests with you.

4. Roles under the AI Act

Under the AI Act, Witnium is the provider of Beeable as an AI system, and the Customer is the deployer when using the system in its operations. In essence this means:

• Witnium is responsible for the design of the system, transparency under Art. 50, technical documentation, logging capability, the selection and contractual governance of the underlying model providers, and ensuring that the Service's intended use does not constitute high risk.
• The Customer is responsible for using the Service in accordance with its intended purpose and our instructions, for human oversight within its own organisation, for labelling AI-generated content the Customer publishes where the Regulation requires it (Art. 50(4)), and for ensuring its own users have sufficient AI literacy (Art. 4).
• Changed use shifts the responsibility. If the Customer uses the Service for a high-risk purpose, contrary to its intended use, or makes substantial modifications to the system, the Customer may under Art. 25 of the AI Act itself come to be regarded as a provider, with all the obligations that entails. Such use is prohibited under the Acceptable Use Policy without our written approval.

5. Risk classification and prohibited use

Beeable's intended use — administrative office work, customer relations, documents, prospecting, archives and similar support in businesses and organisations — does not constitute high risk under Annex III of the AI Act. The Service uses no practices prohibited under Art. 5: no social scoring, no manipulative or subliminal techniques, no emotion recognition in the workplace, no biometric categorisation. The Customer's corresponding obligations are set out in the Acceptable Use Policy.

6. Content labelling

Content generated in the Service is AI-generated and must be treated as such. When the Customer publishes AI-generated text for the purpose of informing the public, or distributes other content where the AI Act requires disclosure, the Customer is responsible for labelling (Art. 50(4)); the Service is built to make this easy, and we are progressively introducing machine-readable marking where the format allows (Art. 50(2)). When we ourselves publish AI-generated content, we label it.

7. The human decides

Beeable is built around a simple order of things: the colleagues prepare the work, the human approves it. Drafts, mailings, publications and other actions with effect outside the Customer's account require human approval through the Service's approval flows. No decisions with legal or similarly significant effects for individuals are made in a fully automated way (cf. Art. 22 GDPR). The Customer must maintain this order within its own organisation and must not configure away human review where it is required by law or by this policy.

8. Logging and traceability

The Service keeps audit logs of material events — who did what, what assignments colleagues were given, and what actions were approved — inspired by the logging requirements of Art. 12 of the AI Act. The logs are used for security, troubleshooting, accountability and the Customer's own follow-up. Since 2018, Witnium has been developing cryptographic evidence infrastructure for tamper-evident logging, and is progressively introducing such anchoring in Beeable, so that the authenticity of the logs can be verified even in environments where requirements are at their highest.

9. Underlying models and providers

The colleagues are powered by large language models from established third-party providers, selected on the basis of security, quality and contractual terms. For all of them: contractual prohibitions on using your data for model training, encrypted transfer, and data minimisation. We may switch, upgrade or combine models and providers without prior notice, provided the level of protection and transparency under this policy is maintained. A current list of subcontractors is available on request.

10. Known limitations

Language models are probability-based. This means a digital colleague may misunderstand, oversimplify, provide outdated information or, in rare cases, generate content that sounds confident but is wrong. The Service is designed to reduce the risk — including through source references, grounding in your own data, and approval flows — but the risk can never be entirely eliminated. That is why the duty of review in section 7 of the Terms of Service applies to all Output, always.

11. AI literacy

Under Art. 4 of the AI Act, those who use AI systems must ensure sufficient AI literacy among their staff. We contribute clear documentation, this policy and guidance in the Service; the Customer is responsible for ensuring that its own users understand the essentials — above all that the colleagues are AI, that they can be wrong, and that a human approves.

12. Data, security and privacy

All AI processing is covered by the Privacy Policy and the Data Processing Agreement: EU-first storage and operations, third-country transfers only under a valid transfer mechanism, encryption, per-customer data isolation, and minimisation of what is shared with model providers. Your conversations and your data are never used to train models and are never sold.

13. Incidents and contact

Serious incidents related to the Service's AI features are handled under our incident procedures and reported to the competent authorities where applicable law requires it. Questions about this policy, or observations of unexpected behaviour by a digital colleague, are gratefully received via admin@witnium.com.

14. Changes

AI regulation and the technology evolve, and this policy is updated in step with them. Material changes are announced in accordance with the Terms of Service. Our position, however, does not change: full openness about the colleagues being AI, and the human always has the final say.

1. Commitment and scope

This Service Level Agreement (the "SLA") applies to the Service's core functions: login, the Office, launched tools and digital colleagues, and associated APIs, for Customers with a paid subscription. Our target is a monthly availability of at least 99.9%. Beta Features, free accounts and features expressly excluded are not covered by this SLA.

2. Measurement

Availability is measured per calendar month as the proportion of minutes the Service's core functions were available out of the month's total minutes, based on our own monitoring, less the exclusions in section 3. The Service is considered unavailable when the core functions are inaccessible or substantially unusable for the Customer for reasons for which we are responsible.

3. Exclusions

When calculating availability, unavailability is not counted where it is due to:

• planned maintenance under section 7;
• faults, outages or capacity limitations in third-party services beyond our reasonable control — including providers of AI language models, external data sources, payment services, DNS, or regional outages at hosting providers;
• the Customer's own equipment, connectivity, software or configuration;
• suspension or restriction carried out in accordance with the Terms of Service or the Acceptable Use Policy;
• force majeure as defined in the Terms of Service;
• Beta Features.

Individual AI responses that are slow or need to be re-run due to temporary load at a model provider do not constitute unavailability, but we actively maintain fallback routes between providers to minimise the impact.

4. Service credits

Service credits are calculated on the fixed monthly fee for the affected month (excluding credit top-ups), are deducted from an upcoming invoice, can never exceed 25% of the monthly fee for any single month, and are not paid out in cash. Credits are forfeited if the agreement is terminated by the Customer before they have been used, except where the termination is due to the availability shortfall itself.

5. How to claim a credit

Claims for service credits are made in writing to admin@witnium.com within thirty (30) days of the end of the affected month, stating the account, the times, and the impact experienced. Claims received later do not qualify for a credit. We acknowledge and respond to claims within ten (10) business days.

6. Support and response times

The digital colleagues, including the platform colleague, are available in the Service around the clock. Human support is reached via the Service or admin@witnium.com and is staffed on weekdays (excluding Swedish public holidays) 09:00–17:00 Swedish time. We begin handling according to the following target times:

7. Planned maintenance

Planned maintenance expected to cause noticeable unavailability is announced at least forty-eight (48) hours in advance in the Service and is scheduled, as far as possible, for low-traffic periods. Such maintenance does not normally exceed four (4) hours per calendar month. Urgent security maintenance may be carried out without prior notice.

8. Sole remedy

Service credits under this SLA constitute the Customer's sole compensation and exclusive remedy for availability shortfalls or outages, except to the extent mandatory law provides otherwise. This SLA confers no right to damages, price reductions or other remedies beyond those stated here.